{
"id": "<string>",
"type": "checklist.item_submitted",
"api_version": "2026-10-30",
"created_at": "<string>",
"organization_id": "<string>",
"data": {
"client_id": "<string>",
"checklist_id": "<string>",
"item_id": "<string>",
"kind": "<string>"
}
}Webhook events
Checklistitem submitted
The client submitted a checklist item. Sent as a POST to every active endpoint that listens to this type. Verify Redbark-Signature (t=<unix seconds>,v1=<hex>): HMAC-SHA256 of "<t>.<raw body>" keyed with the whole endpoint secret, lowercase hex. During a secret roll there is one v1 per active secret; accept any match. Reject a t more than 5 minutes from your clock. Answer 2xx within 10 seconds. Anything else is retried up to 8 times over about 45 hours. Dedupe on id.
WEBHOOK
checklist.item_submitted
{
"id": "<string>",
"type": "checklist.item_submitted",
"api_version": "2026-10-30",
"created_at": "<string>",
"organization_id": "<string>",
"data": {
"client_id": "<string>",
"checklist_id": "<string>",
"item_id": "<string>",
"kind": "<string>"
}
}Authorizations
A firm API key, shown once when it is made, or a connected app’s OAuth access token. Each operation lists the scope it needs, such as clients:write.
Headers
t=,v1=, one v1 per active secret.
The event id, as in the body.
The event type, as in the body.
The delivery id.
Body
application/json
The event id. The same on every retry.
Available options:
checklist.item_submitted Available options:
2026-10-30 When the change happened, in UTC.
The firm.
Show child attributes
Show child attributes
Response
200
Any 2xx marks the delivery as succeeded.