user.deactivated

A user was deactivated or soft-deleted.

Category: User Lifecycle

Emitted when: See the backend emitter for the exact call site.

Envelope

Every delivery wraps the event-specific data block in the canonical envelope documented on the webhook overview page:

Field	Type	Description
event_id	string	ULID; globally unique. Safe to persist as the dedup key.
event_type	string	Always user.deactivated for this event.
api_version	string	Payload schema version (YYYY-MM-DD).
timestamp	integer	Unix epoch seconds at dispatch time.
nonce	string	ULID; unique per delivery, used for replay rejection.
data	object	Event-specific payload (see below).
signature	string	sha256=<hex> HMAC signature.

Data schema

(schema has no declared properties)

Sample payload

{
  "event_id": "evt_01JXYZSAMPLE000000000000",
  "event_type": "user.deactivated",
  "api_version": "2026-05-29",
  "timestamp": 1745339401,
  "nonce": "01HXNONCE0000000000000000",
  "data": {},
  "signature": "sha256=d465098201421848bbd11af4f0d13aca6b98d61b2304ccec9032a913aa281795"
}

Retry behaviour

Failed deliveries retry on the sequence 2, 4, 8, 16, 32 seconds (five attempts plus the initial call for a total of six over approximately 62 seconds of wall clock). After the final attempt the delivery lands in the dead-letter queue and the dashboard operator can replay it from Settings > API Keys > Webhook Endpoint > Deliveries. See the webhook overview for the full rules.

Verification

Every receiver MUST verify the X-Valara-Signature header using the recipe in the webhook overview. Rejecting deliveries whose timestamp is more than 5 minutes off your wall clock (after NTP correction on your side) or whose nonce has already been consumed in the last 10 minutes is part of the contract.