Send an inbound event

curl --request POST \
  --url https://api.usenexio.com/api/v1/events/ingest/{source_key} \
  --header 'Content-Type: application/json' \
  --data '
{
  "type": "crm.account_updated",
  "subject": "account/ACC-10442",
  "body": {
    "account_id": "ACC-10442",
    "changed_fields": [
      "mailing_address",
      "primary_contact"
    ],
    "updated_by": "dana.ortiz"
  },
  "occurred_at": "2026-09-23T15:04:05Z"
}
'

import requests

url = "https://api.usenexio.com/api/v1/events/ingest/{source_key}"

payload = {
    "type": "crm.account_updated",
    "subject": "account/ACC-10442",
    "body": {
        "account_id": "ACC-10442",
        "changed_fields": ["mailing_address", "primary_contact"],
        "updated_by": "dana.ortiz"
    },
    "occurred_at": "2026-09-23T15:04:05Z"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    type: 'crm.account_updated',
    subject: 'account/ACC-10442',
    body: JSON.stringify({
      account_id: 'ACC-10442',
      changed_fields: ['mailing_address', 'primary_contact'],
      updated_by: 'dana.ortiz'
    }),
    occurred_at: '2026-09-23T15:04:05Z'
  })
};

fetch('https://api.usenexio.com/api/v1/events/ingest/{source_key}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "delivery_id": "0d9b7c4e-2a61-4f38-9e15-6c3a8b2f7d90",
  "outcome": "appended",
  "event_id": "4a8e2d71-5c93-4b06-8f1e-9d2c7a3b6e58",
  "inserted": true
}

POST

api

events

ingest

{source_key}

Send an inbound event

curl --request POST \
  --url https://api.usenexio.com/api/v1/events/ingest/{source_key} \
  --header 'Content-Type: application/json' \
  --data '
{
  "type": "crm.account_updated",
  "subject": "account/ACC-10442",
  "body": {
    "account_id": "ACC-10442",
    "changed_fields": [
      "mailing_address",
      "primary_contact"
    ],
    "updated_by": "dana.ortiz"
  },
  "occurred_at": "2026-09-23T15:04:05Z"
}
'

import requests

url = "https://api.usenexio.com/api/v1/events/ingest/{source_key}"

payload = {
    "type": "crm.account_updated",
    "subject": "account/ACC-10442",
    "body": {
        "account_id": "ACC-10442",
        "changed_fields": ["mailing_address", "primary_contact"],
        "updated_by": "dana.ortiz"
    },
    "occurred_at": "2026-09-23T15:04:05Z"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    type: 'crm.account_updated',
    subject: 'account/ACC-10442',
    body: JSON.stringify({
      account_id: 'ACC-10442',
      changed_fields: ['mailing_address', 'primary_contact'],
      updated_by: 'dana.ortiz'
    }),
    occurred_at: '2026-09-23T15:04:05Z'
  })
};

fetch('https://api.usenexio.com/api/v1/events/ingest/{source_key}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "delivery_id": "0d9b7c4e-2a61-4f38-9e15-6c3a8b2f7d90",
  "outcome": "appended",
  "event_id": "4a8e2d71-5c93-4b06-8f1e-9d2c7a3b6e58",
  "inserted": true
}

Behavior

No API key. A nexio source’s request is authenticated by X-Nexio-Signature, an HMAC-SHA256 over timestamp + "." + raw_body keyed with the source’s evsec_ signing secret. Sign the exact bytes you send. See Inbound events for curl, Python, and TypeScript examples that compute the signature. The source_key in the path alone decides the organization.
ams360_ons sources are the exception. AMS360, a supported system type, cannot sign a body, so that source authenticates by the authentication code the sending system includes with each notification. A missing or wrong code answers 401 invalid_credentials. Its delivery identity is the SHA-256 of the body, so a repeated identical notification appends nothing.
Idempotent on X-Nexio-Delivery. For a nexio source, a retry with the same delivery ID and the same bytes returns the first answer with inserted: false and appends nothing. The same delivery ID with different bytes gets 409 delivery_id_reused.
Rejections are recorded. A request whose content the source does not allow is recorded as rejected and answered 422, with the reason as code. Retrying it returns the same 422.
Ignored is success. A valid request that produces no event (for example a GitHub ping) answers 200 with outcome: "ignored" and a reason.
Order of checks: rate limit, body size (1 MiB), source key, signature or authentication code, source enabled, content.
Rate limits: 120 requests per minute per client address and 600 per minute per source key, answered 429 rate_limited with Retry-After.
GitHub sources use GitHub’s own headers (X-Hub-Signature-256, X-GitHub-Delivery, X-GitHub-Event) and body instead of the envelope below. See GitHub deployments.
Sources are registered by Nexio. A source accepts no events until Nexio enables it.

Headers

X-Nexio-Delivery

string

Required for nexio sources. Your unique ID for this delivery. Reuse it only to retry the same bytes.

Example:

"0d9b7c4e-2a61-4f38-9e15-6c3a8b2f7d90"

X-Nexio-Timestamp

string

Required for nexio sources. Current Unix time in seconds, decimal digits only. Must be within 300 seconds of Nexio's clock.

Pattern: ^[0-9]+$

Example:

"1790175845"

X-Nexio-Signature

string

Required for nexio sources. t=<timestamp>,v1=<hex HMAC-SHA256 of timestamp + "." + raw body>. t must equal X-Nexio-Timestamp. More than one v1 value is accepted; the request passes when any one matches.

Example:

"t=1790175845,v1=5c2f8e1a9b3d7c4e6f0a2b8d1e9c7a3f5b6d4e2c8a0f1b3d9e7c5a2f4b6d8e0c"

Path Parameters

source_key

string

required

The ingest source key Nexio issued (evsrc_ followed by 64 hex characters).

Example:

"evsrc_example000000000000000000000000000000000000000000000000000000000"

Body

application/json

The body a nexio ingest source posts. Nexio sets the organization, produced_by: ingest, and transition_cause: world_change; a sender cannot set them. Unknown top-level fields are ignored.

type

string

required

Event type. Must be one of the source's configured types and not a reserved type.

subject

string

required

What the event is about, for example account/ACC-10442. Must not be blank.

Minimum string length: 1

body

object

required

A JSON object of IDs and changed fields.

occurred_at

string<date-time>

When the change happened. Defaults to the time Nexio received the request.

dedupe_key

string

The event's identity within its type and subject. Defaults to the X-Nexio-Delivery value.

Response

Delivery recorded. inserted is false for a byte-identical retry of a delivery already recorded.

The result of one accepted ingest delivery.

delivery_id

string

required

The delivery's identity. The X-Nexio-Delivery value for a nexio source, the X-GitHub-Delivery value for a github source, and sha256: followed by the body's SHA-256 hex for an ams360_ons source.

outcome

enum<string>

required

appended: an event is in the log. ignored: valid, but no event was produced; see reason.

Available options:

appended,

ignored

inserted

boolean

required

false when this delivery ID and body were already recorded. Nothing new happened.

reason

enum<string>

Present when outcome is ignored.

Available options:

event_not_translated,

status_not_configured

event_id

string<uuid>

The event's ID when outcome is appended. If an event with the same identity already existed, its ID.

Last modified on September 25, 2026

Overview

Engines

Environments

Conversations

Webhooks

Events

Records

Graph

Platform

Send an inbound event

Behavior

Headers

Path Parameters

Body

Response

​Behavior

Headers

Path Parameters

Body

Response

Behavior