grant.created

POST

A new grant exists: an end user finished the connect flow, or POST /v1/connections/{id}/grants added one. Not sent for a reconnect of an existing grant (that is connection.restored).

Authorizations

• apiKey
• grantToken

Parameters

Header Parameters

x-inboxcnx-signature

required

t=<unix seconds>,v1=<hex HMAC-SHA256>. The MAC covers <t>.<raw body> with the endpoint’s signing secret. During a secret rotation a second v1 carries the previous secret’s MAC. Reject a t older than 5 minutes.

string

Example

t=1761206400,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

t=<unix seconds>,v1=<hex HMAC-SHA256>. The MAC covers <t>.<raw body> with the endpoint’s signing secret. During a secret rotation a second v1 carries the previous secret’s MAC. Reject a t older than 5 minutes.

x-inboxcnx-event-id

required

The envelope’s id. Stable across retries: dedupe on it.

string

The envelope’s id. Stable across retries: dedupe on it.

Request Body

Media typeapplication/json

object

id

required

string

>= 1 characters

createdAt

required

string

applicationId

required

string format: uuid

grantId

required

string | null format: uuid

externalUserId

required

string | null

type

required

string

Allowed values: grant.created

data

required

object

connection

required

object

id

required

string format: uuid

provider

required

string

Allowed values: gmail m365 imap

accountEmail

required

string

profileKey

required

string

Example

{
  "id": "grant.created:9b2f0c4e-6a1d-4f3b-8c55-0d7e2a91b3c4:2026-10",
  "type": "grant.created",
  "createdAt": "2026-10-23T08:00:00.000Z",
  "applicationId": "a3c1e8f2-4b7d-4e9a-9f10-6d2b8c5e7a41",
  "grantId": "9b2f0c4e-6a1d-4f3b-8c55-0d7e2a91b3c4",
  "externalUserId": "crm-user-42",
  "data": {
    "connection": {
      "id": "5e8d2a10-3c4b-4f6e-9a7d-1b2c3d4e5f60",
      "provider": "gmail",
      "accountEmail": "owner@example.com"
    },
    "profileKey": "default"
  }
}

Responses

2XX

Delivered. The body is ignored.

default

A 408, 429, 5xx, a timeout or a network error is retried with backoff. Any other status, and a redirect (never followed), ends the delivery as failed.