> ## Documentation Index
> Fetch the complete documentation index at: https://thehyperstack.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Events

> What Hyperstack sends to your webhook endpoint.

After you [subscribe to a webhook](/docs/api-guide/webhook-subscribe), Hyperstack sends a `POST` request to your URL each time one of your credentials is published. If publishing fails, no event is sent. This happens for every credential, however it was issued: in the Studio, from a CSV file, through the API or through an integration.

## `credential.issued`

The body is JSON, with the header `Content-Type: application/json`:

```json theme={null}
{
  "event": "credential.issued",
  "credential": {
    "document_id": "6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b",
    "document_url": "https://hyperstack.id/credential/6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b",
    "recipient": {
      "name": "Jane Doe",
      "email": "jane.doe@example.com"
    },
    "group": {
      "title": "Cloud Security Fundamentals",
      "key": "Kq7Zp2LmX9aB",
      "code": "CSF-2026"
    },
    "metadata": {
      "custom_grade": "A"
    },
    "issued_on": "2026-03-15 10:30:04.887215+00:00"
  }
}
```

**event** `string`

Always `"credential.issued"`.

**credential** `object`

The credential that was published.

**properties**

**document\_id** `string`

ID of the credential. Use it with [View Credential](/docs/api-guide/view-credential).

**document\_url** `string`

Public page of the credential.

**recipient** `object`

The recipient's `name` and `email`.

**group** `object`

The group's `title`, `key` and `code`.

**metadata** `object`

The credential's custom attribute values.

**issued\_on** `string`

When the credential was published, in UTC. Note the format: `YYYY-MM-DD HH:MM:SS.ffffff+00:00`, with a space, not the `T` used in API responses.

## Delivery

* Hyperstack waits up to 10 seconds for your endpoint to answer.
* Any `2xx` status counts as delivered. Return `200` quickly, and do slow work after you answer.
* A failed delivery, such as a non-`2xx` status, a timeout or a connection error, is not retried.
* Events can arrive out of order.

## Security

Webhook requests are not signed. Before you trust a payload, fetch the credential with [View Credential](/docs/api-guide/view-credential) using its `document_id`. Use an `https://` URL that is hard to guess.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.