The envelope
Every request body is a CloudEvents 1.0 JSON document. The same attributes appear on every event, anddata holds the fields for that event type.
Every timestamp, in
time and in data, uses one format: 2026-09-01T10:15:30.123Z.
App events
These 5 events let you keep a copy of each app’s state in your own system. Every one carries the same 3 identifying fields, plus a timestamp for the change.
Events carry IDs only. App names, app content and personal details are never included.
app_type is one of user_app (an app), user_agent (a Superagent), user_game (a game) or imported_app (an app imported from a repository).
Example: app.created.v1
A complete request body for a new app:Builder events
These 2 events tell you when the AI builder works on a message sent to an app, so a platform that sends messages from its own server doesn’t have to hold the request open or poll for the result. A turn is one message and everything the builder does in response, including the automatic error fixes it runs before it replies. Both carry the 3 identifying fields of the app events, plus:status is one of:
finished: the builder replied and has nothing pending.waiting_for_user_input: the builder stopped to ask something, such as a clarifying question or a plan to approve. It continues when the next message answers it.failed: the turn hit an error.cancelled: the turn was stopped before it ended.interrupted: the builder was interrupted, for example by a restart. It continues in a new turn whosecontinues_message_idis this turn’smessage_id.
The activation test
Base44 sendswebhook.test.v1 when an endpoint is activated or tested. You can’t select it, and it’s sent to every endpoint that’s being activated. Its subject is endpoints/{endpoint_id}.
To learn how to answer it, see Echoing the challenge.
JSON Schemas
Each event type has a JSON Schema for itsdata, at the URL in the event’s dataschema attribute:
A published schema never changes. When an event’s fields change in a way that could break your receiver, Base44 adds a new version, such as
app.created.v2, and keeps sending the old one to endpoints that selected it.
The Audit Logs API has events with similar names, such as
app.created. They’re a separate record with their own fields, so the 2 can differ.