Subscriber insight status changed Webhook

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL

https://api-reference.usecommune.dev/mcp

Standard setup for AI tools providing an mcp.json file

mcp.json
{
  "REST API MCP server": {
    "url": "https://api-reference.usecommune.dev/mcp"
  }
}

Close
POST https://webhook.example.com

A reader crossed a boundary in the newsletter's engagement ladder: reader to superfan, or engaged to dormant. This is the moment a CRM or a re-engagement automation has something to do; the scores themselves are on GET /newsletters/{newsletter}/insights.

Fired by a scheduled scoring pass, once per reader whose status actually differs from the one already stored, so a pass that changes only the scores is silent.

occurred_at is when the crossing was computed, not when the reader acted. data.last_action_at is the reader's own clock and sits earlier by up to a full scoring interval. Read that field to react while the moment is still warm.

Status is a rank inside this newsletter, not an absolute score, so a reader who did nothing can be demoted because the audience around them got busier. Two events that look like opposite movements can arrive from one pass without either reader having changed their behaviour.

Only readers with a Commune account are scored, so a subscriber the newsletter knows only as an address never produces this event.

Not the same as subscriber.unsubscribed, which reports the subscription ending. dormant is a reader who went quiet, not one who left.

Delivered as a single HTTPS POST to the consumer's registered endpoint, with the message as the JSON request body. Respond 2xx to acknowledge. Anything else, or a timeout, is retried with backoff, so acknowledge fast and do the work afterwards.

Headers

  • Commune-Version string Required

    API version the payload conforms to. Same value as api_version in the envelope.

  • Commune-Event-Id string(uuid) Required

    Same value as id in the envelope. The dedupe key.

  • Commune-Event-Type string Required

    Same value as type in the envelope. The topic name.

  • Commune-Signature string Required

    HMAC-SHA256 over Commune-Timestamp as Unix seconds, a literal ., then the raw request body, keyed by the endpoint's signing secret. Lowercase hex, carried as v0= followed by one or more comma separated digests (more than one while a secret is being rotated). The header's timestamp is an RFC 3339 instant, so convert it to Unix seconds before signing. Verify against the raw bytes before parsing the JSON. The webhooks guide has the full procedure.

  • Commune-Timestamp string(date-time) Required

    When this delivery attempt was made, as an RFC 3339 instant in UTC. It differs on every retry, and it IS covered by the signature, in Unix seconds, so a stale or altered one can be rejected. Enforce a tolerance window of a few minutes and dedupe on the event id as well, since a retry inside that window is legitimate.

  • Commune-Delivery-Attempt integer

    1 on the first attempt, incremented on each retry. Not sent today: do not rely on it, and be idempotent regardless. The same number is readable after the fact as attempt on a DeliveryAttempt, so a consumer that needs to tell a retry from a first delivery can ask instead of being told.

    Minimum value is 1.

application/json

Body Required

A reader crossed a boundary in the newsletter's engagement ladder.

  • id string(uuid) Required

    Unique id for this event. Stable across redeliveries, so it is the dedupe key. Assigned when the state change is recorded rather than when the message is dispatched.

  • type string Required

    The topic name, identical to the channel address. Route on this.

    Value is subscriber.status_changed.

  • api_version string Required

    The Commune-Version value this payload conforms to. Present on the message itself, not only on the request header, so an event persisted to a consumer's own store stays self-describing.

  • occurred_at string(date-time) Required

    RFC 3339 timestamp of the state change, not of the delivery attempt. Use it to order events, since delivery order is not guaranteed.

  • newsletter_id string(uuid) | null Required

    The newsletter the change belongs to. This is the tenant boundary: a consumer only ever receives events for newsletters its credential can read. Null only for events that are genuinely not newsletter-scoped, which none of the topics Commune publishes currently are.

  • actor object | null Required

    Who caused the change, and null when nobody in particular did.

    Populated on a change made through this API's write operations, where it is the credential, and on a change one of the newsletter's own automations made, where it is the run. Null on every other change: an edit a creator made in the product, an import arriving from a provider, a scheduled job, a delivery result reported by the sending provider. Null is therefore the common case and stays a legitimate value. Read it as "this change was attributed", never as "nothing caused this".

    It never names a person: an api_key actor is the credential and a system actor is an automation run.

    It answers "did this change come in through the API, and under which credential". It is not the field to drop the echo of your own write with: use idempotency_key, which you chose and therefore already know, whereas id here is Commune's own identifier for your credential and no operation reports it back to you. A creator can read that identifier in Commune, but it changes when the credential is replaced, so matching on it puts the loop back silently after a rotation.

    Additional properties are NOT allowed.

    Hide actor attributes Show actor attributes object | null
    • type string Required

      api_key for a change made through this API. system for a change one of the newsletter's own automations made, where id is the automation run and label names the automation: see automation.run.started for what that attribution is for. user is reserved for a change a named person made through an authenticated session and is not emitted.

      An OAuth access token reports as api_key as well. The two credentials are interchangeable everywhere else in this API, and a separate value here would be a distinction a consumer cannot act on.

      Values are user, api_key, or system.

    • id string Required

      Identifier of the actor within its type. For api_key it is the credential's own id and never its secret, and it is the same value that appears in a creator's list of credentials, so an event can be traced back to the integration that caused it.

    • label string | null

      Human-readable name for display. Best effort, may be null.

  • idempotency_key string | null Required

    The Idempotency-Key of the API write that caused this change, so a consumer can tie an event back to its own request and collapse the duplicates a retried write would otherwise produce.

    This is how a consumer that writes recognises its own work. Keep the keys you send, and skip any event carrying one of them. You chose the value, so you know it before the event arrives. actor cannot do this job, because Commune's id for your credential is not something this API reports to you.

    Null for every change that did not come in through this API, which is most of them: an edit made in Commune, an import, a scheduled job and a delivery result all have no originating request to key on.

    It reaches every endpoint registered for the newsletter, not only the one that made the write, so choose opaque keys such as UUIDs rather than keys carrying your own business identifiers.

    Maximum length is 255.

  • data object Required

    Event-specific body. Narrowed by each concrete event schema below.

    Hide data attributes Show data attributes object
    • subscriber_id string(uuid) Required

      The subscriber this score belongs to, the same identifier the other subscriber.* topics carry.

    • user_id string Required

      The Commune account the score is attributed to. Insights are keyed on the account rather than on the subscription, because half the signal is community activity that belongs to a person and not to a mailing list entry. Always present: an unscored subscriber cannot cross a boundary.

    • email string(email) Required

      Where the newsletter reaches this reader, so a consumer can match the event against its own records without a second call. Resolved from the Commune account when the subscription row itself carries no address.

    • previous_status string | null

      Where a reader sits in the newsletter's engagement ladder, from dormant at the bottom to superfan at the top.

      Assigned by rank inside the newsletter rather than against an absolute score, so it is a statement about this audience and never comparable between two newsletters. It also means a reader can move without doing anything, because the people around them moved.

      Values are superfan, engaged, reader, or dormant.

    • status string Required

      Where a reader sits in the newsletter's engagement ladder, from dormant at the bottom to superfan at the top.

      Assigned by rank inside the newsletter rather than against an absolute score, so it is a statement about this audience and never comparable between two newsletters. It also means a reader can move without doing anything, because the people around them moved.

      Values are superfan, engaged, reader, or dormant.

    • direction string Required

      Which way along the ladder the reader moved, derived from the two statuses so a consumer does not have to hardcode their order. promoted the first time a reader is scored, because there is no earlier position they could have fallen from.

      Values are promoted or demoted.

    • total_score integer Required

      The blended score at the moment of the crossing, summed across the community and the newsletter's email provider. It has no unit and no ceiling, and is meaningful only ranked against the other readers of the same newsletter.

    • velocity string Required

      The last fourteen days of points against the fourteen before them. Read it with direction: a demotion while rising means the audience around this reader moved faster, not that the reader slowed down.

      Values are rising, cooling, or steady.

    • last_action_at string(date-time) | null

      When the reader last did anything that earned points. The reader's own clock, not the scoring pass's, so it sits earlier than occurred_at by up to a full scoring interval. Null for a reader who has never acted.

Responses

  • 200

    The consumer accepted the delivery. Any 2xx acknowledges the message and it is not sent again.

  • 4XX

    The consumer rejected the delivery. Handled exactly like a 5xx: the message is retried with backoff, because a rejection cannot be told apart from a consumer that is briefly misconfigured.

  • 5XX

    The consumer failed to handle the delivery. Retried with backoff. A timeout is the same case and is retried too.

POST subscriber.status_changed
Request examples
{
  "id": "018f2a91-dddd-7000-8000-00000000000d",
  "type": "subscriber.status_changed",
  "api_version": "2026-08-26",
  "occurred_at": "2026-08-27T03:15:00Z",
  "newsletter_id": "7d3f1c02-58a1-4a4e-9a0b-2f6d1c9e4411",
  "actor": null,
  "idempotency_key": null,
  "data": {
    "subscriber_id": "33445566-7788-4990-a1b2-c3d4e5f60718",
    "user_id": "usr_2Nf8Kq1pWc",
    "email": "reader@example.com",
    "previous_status": "reader",
    "status": "superfan",
    "direction": "promoted",
    "total_score": 412,
    "velocity": "rising",
    "last_action_at": "2026-08-26T21:04:11Z"
  }
}
{
  "id": "018f2a91-eeee-7000-8000-00000000000e",
  "type": "subscriber.status_changed",
  "api_version": "2026-08-26",
  "occurred_at": "2026-08-27T03:15:00Z",
  "newsletter_id": "7d3f1c02-58a1-4a4e-9a0b-2f6d1c9e4411",
  "actor": null,
  "idempotency_key": null,
  "data": {
    "subscriber_id": "44556677-8899-4aa1-b2c3-d4e5f6071829",
    "user_id": "usr_7Zx3Lm9qRt",
    "email": "quiet@example.com",
    "previous_status": "engaged",
    "status": "dormant",
    "direction": "demoted",
    "total_score": 88,
    "velocity": "cooling",
    "last_action_at": "2026-07-02T09:12:40Z"
  }
}