USER_UPDATED
USER_UPDATED is sent in two cases:
Trigger | What you receive |
A successful | One delivery for the updated user. |
A | One delivery for each user on the page returned. These deliveries also carry the user’s login |
addNewUser does not send this webhook.
Request format
The request is an HTTP POST with a multipart/form-data body, not a raw JSON body.
Field | Type | Description |
| string | Always |
| string | A JSON-encoded string describing the user. Decode it after reading the form field. |
Headers:
Header | Description |
| Hexadecimal HMAC-SHA256 signature. See Webhook security. |
| The timestamp used to build the signature. |
Example
POST /webhooks/spendstream HTTP/1.1
Content-Type: multipart/form-data; boundary=------------------------7d1f
Signature: 8a1e47...example...c90f
TimeStamp: 2026-09-29 10:20:00
--------------------------7d1f
Content-Disposition: form-data; name="eventType"
USER_UPDATED
--------------------------7d1f
Content-Disposition: form-data; name="user"
{"UID":"test-user-001","email":"jane.doe@email.com","name":"Jane","phone":"","status":"1"}
--------------------------7d1f--
The user field holds a JSON string. Once decoded it contains:
Field | Description |
| Your identifier for the user. |
| The user’s email address. |
| The user’s display name. |
| The user’s phone number. Often empty. |
|
|
| The user’s login token. Only sent when the delivery comes from |
Handling the event
- Verify the signature and timestamp.
- Decode the
userJSON string. - Match the record using the user identifier (your
UID) and upsert it. - Return
200quickly.
There is no event identifier. If the same user update arrives twice, applying it twice must leave your data unchanged. See Webhook processing best practices.
⚠️ Warning: Treat any login token that appears in a user payload as a secret. Do not log it, and do not pass it to the browser except in the redirect described in the White-label SSO guide.
On this page
- USER_UPDATED