Event catalog

Events arrive two ways — webhooks (push, signed) and GET /v1/events (poll, cursor). Both are strictly scoped to your business.

Delivery shape

{
  "id": "5b0e7c0a-…",
  "type": "consumer.updated.email",
  "created_at": "2026-07-27T17:00:00.000Z",
  "share_id": "9a1f2e3d-…",
  "data": { "email": "new@example.com" }
}

data is present only for update events; it is stored encrypted under the affected share’s key and decrypted at delivery time.

Lifecycle events

Type	Fires when
share.created	A consumer consents through your button
share.expiring	7 days and again 1 day before expiry
share.expired	Consent duration elapsed — stop using the data
share.revoked	Consumer severed the share; the cease-contact clock starts
share.renewed	Consumer re-consented; a fresh share supersedes the old
business.ceased	Your cease-contact acknowledgement was recorded

Update events

Delivered only for active shares whose scope includes the changed field:

Type	Fields
consumer.updated.email	email
consumer.updated.phone	phone
consumer.updated.address	address_line1,address_line2,city,state,zip,country
consumer.updated.name	first_name,last_name

Revoked, expired, and ceased shares never receive updates.

Polling

curl -H "Authorization: Bearer sk_live_…" \
  "https://api.pryvc.com/v1/events?cursor=0&limit=50"

Persist next_cursor between polls; events are strictly ordered by seq. Delivery is at-least-once — de-duplicate by event id.

certificate.revoked

The subject of a certified consent withdrew it, having proved control of the email address on the certificate. Carries cert_id rather than share_id, since certificates are issued to people with no account and no share.

A 10-business-day cease-contact deadline starts when this fires. The certificate is not deleted — it reads revoked on its public verification page, with the original agreement and the withdrawal both timestamped.

There is no decline event

Closing the consent sheet emits a local pryvc:closed in that browser and nothing else — no server call, no webhook, no record. That is deliberate rather than missing: see What you hold.