Skip to main content

Team

New to webhooks? Start with Getting started (envelope, delivery, retries) and Verification (confirming a request came from Grow CRM). Those conventions apply to every event below and are not repeated here.
Team members expose three keys: team.created, team.updated, team.deleted. There is no .sundry or .activity — every change to a team member arrives as team.updated, and team members have no child records. These events cover team members only. Client contacts are not included.

What the payload does and does not contain

The payload is a deliberate, fixed whitelist of profile fields. Credentials and security material — password hashes, session and password-reset tokens, two-factor secrets, last-known IP address, payment-gateway customer ids — are never included, and cannot be exposed by a future change to the underlying record. Personal preferences (theme, language, notification and filter settings) are also excluded, as they are local UI state rather than shared record data.

The team member object

.created and .updated carry this shape — flat for .created, nested under team_member for .updated:

team.created

Fires when a team member is added. data is the full team member object above. The new member is also emailed a generated password at this point; that password is never included in the payload.

team.updated

Fires on any change to a team member. data.change tells you which; data.team_member is the full object. Compare role and status against your own copy if you need to react specifically to a permission change or a suspension.
A team member changing their own preferences does not fire an event.

team.deleted

Fires after a team member is removed. data is just the id. Deletion is a soft delete: the account row is kept for referential integrity, its status set to deleted, and its email, password, role and avatar cleared. Treat team.deleted as final — the member cannot log in again and will not appear in the team list.