Skip to navigation
APIWebhook Events

filing.landed

Fires once per public filing of a company the organization follows, when the filing is first stored; never for a filing more than 30 days old when it is stored. The payload carries the accession, the registrant, the form, the filing date and the appends, what the filing made readable. Fetch the statements through the store routes under /api/public/.

Headers

SpreadSpace-SignaturestringRequired

Signature over the exact request body: t=<seconds since the Unix epoch>,v1=<lowercase hex HMAC-SHA256 of "{t}.{body}" keyed with your endpoint's signing secret>. Verify it before trusting the body, and reject a t more than five minutes from your own clock. During a secret rotation both the new and the previous secret verify for 24 hours; each delivery is signed with exactly one.

SpreadSpace-Event-IdstringRequiredformat: "^evt_[0-9a-f]{24}$"

The event id, identical to the body’s id. Stable across retries and replays, and shared by every endpoint one event fans out to. Delivery is at-least-once, so dedupe on it.

Payload

The payload of this webhook request is an object.
idstringRequiredformat: "^evt_[0-9a-f]{24}$"

Event id: evt_ plus 24 lowercase hex characters. Also sent as the SpreadSpace-Event-Id header. Stable across retries and replays, so dedupe on it.

typeenumRequired
Always this event type on this body.
Allowed values:
created_atdatetimeRequired

Server-side wall-clock time the event was created, RFC 3339. Deliveries are not ordered; reconcile on this.

tenant_idstringRequired
The workspace the event belongs to. Reject a delivery whose tenant does not match the endpoint you registered.
livemodebooleanRequired

true for live activity, false for test mode (an ss_test_ key or the sandbox simulator). Branch on it to route test deliveries to a staging handler.

dataobjectRequired

The data object on a filing.landed, filing.extracted or filing.superseded delivery, sent once per public filing of a company the organization follows, and never for a filing more than 30 days old when it is stored.

A pointer with the appends: the filing’s accession, registrant, form and date, and what the filing made readable. The appends ride the event so a consumer learns what became readable without a second call; the statements themselves are fetched through the store routes under /api/public/, where the caller’s own scope and plan apply.

api_versionstringOptionalformat: "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"

The API version the delivery was rendered under, a date stamp: the same value /v1/openapi.json reports as info.version. The envelope and data have that version’s shape, and a breaking change ships under a new stamp. A delivery recorded before this field existed carries none, and has the 2026-10-07 shape.

Response

2XX
Return any 2xx within 5 seconds. A 4xx other than 429 stops retries for that delivery. 429, 5xx, network errors and timeouts are retried, up to 12 attempts in all.