A pilots grant was revoked

Sent to the partner’s webhook URL when a grant ends: the pilot disconnected the partner in Settings (reason pilot), MyPilotIndex revoked it (operator), or the pilot deleted his account (account_deleted; the grant is then removed and appears in no list). From that moment every call naming the grant answers 404: delete what you hold from MyPilotIndex for that pilot, as the data agreement requires. Deliveries and retries are described in the Webhooks tag; webhook-id is the event id, the same on every attempt. An account_deleted event is retried on any answer but a 2xx, a 4xx included, since it cannot be reconciled later; acknowledge it with a 2xx once you have taken it, even if you hold nothing for that pilot.

WEBHOOK grant.revoked

Example

{
  "type": "grant.revoked",
  "id": "evt_3b1f6c0e9a2d4f7b8c5e1a2b3c4d5e6f",
  "created_at": "2026-11-05T09:30:00Z",
  "data": {
    "grant_id": "6f1c2a9e-3b7d-4c51-9e2a-0d4b8f6a1c33",
    "pilot_id": "2d9b7c1e-8f4a-4e3b-a6d5-91c0f2e7b844",
    "reason": "pilot"
  }
}

Headers

webhook-id · string · required

The event id (the id member of the body), the same on every delivery attempt; dedupe on it.

webhook-timestamp · string · required

The whole Unix seconds when this attempt was signed. Refuse one more than five minutes from your clock.

webhook-signature · string · required

"v1," and the base64 HMAC-SHA256 of "..", over the exact bytes of the body, under the key your secret carries in base64 after its whsec_ prefix. Compare in constant time.

Body

application/json

type · string · required

Allowed value: "grant.revoked"

id · string · required

The event id, sent again as webhook-id on every delivery attempt; dedupe on it.

Pattern: ^evt_[0-9a-f]{32}$

created_at · string<date-time> · required

When the grant was revoked.

data · object · required

Show child attributes

Response

2XX

Acknowledged; the event is not sent again.