Events

The shared webhook envelope and the payload of all five Insy event types — membership, payment and digital product purchase events.

Insy sends five event types, and every active webhook of an eligible user receives all of them. Each delivery uses the same envelope; only the contents of data differ per type. Branch on event_type and ignore anything you do not handle.

The envelope

Every event has the same four top-level fields.

{
  "event_type": "membership.created",
  "event_id": "insy_event_1756742400000_k3f9d2a1x8b",
  "data": {
    "membershipId": "4f9a1c2e-7b3d-4e58-9c01-6d2f8a5b3e17",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756742400000"
}

data.metadata.userProfile

Every payload carries data.metadata.userProfile, the Insy profile of the user the event is about. The examples below abbreviate it as {}. Read the properties you need defensively and ignore the rest; the object is additive.

The data fields listed in the tables below are in addition to metadata.

membership.created

Fires when a membership record is created for a user in a community. Delivered to the webhooks of that community’s owner, admin and moderator members.

Creation is not activation: a membership backed by a not-yet-active Stripe subscription is created with isActive: false, so membership.created can arrive for a member without access. Grant access only when isActive is true, not on the event itself.

{
  "event_type": "membership.created",
  "event_id": "insy_event_1756742400000_k3f9d2a1x8b",
  "data": {
    "membershipId": "4f9a1c2e-7b3d-4e58-9c01-6d2f8a5b3e17",
    "isActive": true,
    "wasActive": false,
    "role": "member",
    "validFrom": "2025-09-01T16:00:00.000Z",
    "validUntil": "2025-10-01T16:00:00.000Z",
    "lastPaymentMethod": "stripe",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756742400000"
}

membership.updated

Fires when a membership’s active state flips — an activation or a lapse. The payload has the same shape as membership.created.

A role change, or a renewal that only moves validUntil while the membership stays active, does not produce a webhook. Poll or re-read the membership if you need those.

The pair wasActive and isActive tells you which direction the membership moved:

wasActive is always the negation of isActive — every membership event is a transition. There is no “nothing changed” delivery.

Deliveries are unordered and can repeat, so do not toggle a flag on receipt — compare against the state you hold and treat isActive and validUntil from the payload as authoritative.

{
  "event_type": "membership.updated",
  "event_id": "insy_event_1756831245880_9qz4m7t2v1c",
  "data": {
    "membershipId": "4f9a1c2e-7b3d-4e58-9c01-6d2f8a5b3e17",
    "isActive": false,
    "wasActive": true,
    "role": "member",
    "validFrom": "2025-09-01T16:00:00.000Z",
    "validUntil": "2025-09-02T16:00:00.000Z",
    "lastPaymentMethod": "stripe",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756831245880"
}

payment.success

Fires when a payment completes. Delivered to the webhooks of the community’s owner, admin and moderator members.

{
  "event_type": "payment.success",
  "event_id": "insy_event_1756742463127_7hd4p9s2n6r",
  "data": {
    "paymentId": "b81d5f60-3c2a-4d19-95e7-0af6c3241b8d",
    "membershipId": "4f9a1c2e-7b3d-4e58-9c01-6d2f8a5b3e17",
    "paymentStatus": "completed",
    "paymentMethod": "stripe",
    "paymentType": "subscription",
    "amountCents": 4900,
    "currency": "pln",
    "periodStart": "2025-09-01T16:00:00.000Z",
    "periodEnd": "2025-10-01T16:00:00.000Z",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756742463127"
}

payment.failed

Fires when a payment does not complete. In practice this means one thing: a subscription renewal invoice Stripe could not charge, typically a declined card. Same field names as payment.success, but fewer of them — see the note below.

A failed payment is not, by itself, a loss of access. The membership state is carried by membership.updated: expect a lapse only when a later event reports wasActive: true with isActive: false.

{
  "event_type": "payment.failed",
  "event_id": "insy_event_1756831188441_c5w8j1r4y0k",
  "data": {
    "paymentId": "e02b7a94-6d15-42c8-b3f1-58ac0d97e264",
    "membershipId": "4f9a1c2e-7b3d-4e58-9c01-6d2f8a5b3e17",
    "paymentStatus": "failed",
    "paymentMethod": "stripe",
    "paymentType": "subscription",
    "amountCents": 4900,
    "currency": "pln",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756831188441"
}

digital.product.purchase

Fires when a digital product is purchased. Unlike the other four, this event is delivered to the webhooks of the product’s creator, not to community moderators.

{
  "event_type": "digital.product.purchase",
  "event_id": "insy_event_1756744812004_m2v6b3t9q7d",
  "data": {
    "membershipId": "a17c8e42-9f05-4b6d-8e31-27c9a4d05f6b",
    "productVariantId": "5d3f0b71-8a24-4c96-a0e5-1b7f62d84c39",
    "paymentId": "c94e2d18-7b60-4f53-8a2c-3e15d097ab42",
    "amountCents": 12900,
    "currency": "pln",
    "validFrom": "2025-09-01T16:40:12.004Z",
    "validUntil": "2026-09-01T16:40:12.004Z",
    "metadata": { "userProfile": {} }
  },
  "timestamp": "1756744812004"
}

Routing the five types

A single handler receives everything, so the dispatch is a switch with a default branch that does nothing but still acknowledges.

function handle(event) {
  switch (event.event_type) {
    case "membership.created":
      // A created membership is not always active — grant only when it is.
      return event.data.isActive ? grantAccess(event.data) : undefined;
    case "membership.updated":
      return event.data.isActive
        ? grantAccess(event.data)
        : revokeAccess(event.data);
    case "payment.success":
      return recordPayment(event.data);
    case "payment.failed":
      return flagDunning(event.data);
    case "digital.product.purchase":
      return fulfilProduct(event.data);
    default:
      // Unknown type: acknowledge and move on.
      return undefined;
  }
}

Signature verification comes first — see Verifying signatures.