Overview
Use this reference to interpret the JSON Mobaro sends to your webhook receiver. A webhook notification is a record snapshot, not the same response as a public API GET. Setup, signatures and retry settings are covered in Using webhooks in Mobaro.
At a glance |
|
Who can do this | Developers receiving webhooks; Super Users configure subscriptions |
Where | Configuration › API › Webhooks and your HTTPS receiver |
Works on | Public API; Backend (web) for setup |
Availability | Managed availability |
Choose the resource and events
1. Match your subscription
Each subscription has one Resource and selected Events. The payload uses the exact resource strings below. The Backend label Queue times is serialized as QueueTimes.
Resource | Events | Typical use |
Users, Locations, Results, Assignments, Notes, Downtimes | Created, Updated, Deleted | Keep a copy or trigger external work. |
Dispatches, QueueTimes | Updated, Deleted | Track new or removed operational entries. |
⚠️ Heads-up: A new Dispatch or Queue time is sent as Updated, not Created. Select Updated to receive new entries.
2. Read the common envelope
Mobaro sends an HTTPS POST with Content-Type: application/json. If a Secret is configured, verify X-Webhook-Signature against the raw body before parsing. The API key header is for requests you make to Mobaro; it is not the webhook signature.
{
"event": "Updated",
"resource": "Locations",
"timestamp": "2026-10-15T09:00:00Z",
"data": {
"id": "locations/345678-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"name": "Cedar Coaster",
"externalId": "RIDE-01",
"email": null,
"language": "en",
"scannerCode": null,
"rideOps": true,
"address": null,
"users": [],
"userGroups": [
"usergroups/2233-A"
],
"properties": [],
"locationGroups": [
"locationgroups/10-A"
]
}
}Field | Meaning |
| Event name and resource type; branch on these values. |
| UTC notification creation time; unchanged when that notification retries. |
| Record identity. Dispatch and Queue time IDs are composite strings; store them unchanged. |
| Record/entry creation and snapshot-update timestamps. Do not assume updated equals the API record’s stored update timestamp. |
| Deletion flag. Process |
The remaining examples are complete data examples for the listed field set, using fictional data and empty optional collections. Wrap them with the same envelope. Null means no value in that example; it is not a promise that every nested object is always null. Dates are ISO 8601. Relationship fields use IDs; preserve arrays and nested objects as structured data.
Fields by resource
Locations. The full example above contains the Location field set. Membership fields are ID lists; address is an object when present. The snapshot does not contain the Location API’s full operations object.
Users. User profile fields; not a permission or group-membership export.
{
"id": "users/123456-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"externalId": "EMP-01",
"name": "Alex Morgan",
"email": "[email protected]",
"profileImage": null,
"phoneNumber": null,
"language": "en",
"forcePasswordChange": false,
"address": null,
"additionalEmails": []
}Results. References use checklist, not the GET response’s checklistId. There are no question answers (values) here; fetch the Result for them.
{
"id": "results/72564-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"checklist": "checklists/654321-A",
"checklistRevision": "example-revision",
"user": "users/123456-A",
"schedule": null,
"location": "locations/345678-A",
"asset": null,
"scheduleSlot": null,
"timezone": "Europe/London",
"language": "en",
"started": "2026-10-15T09:00:00Z",
"answered": "2026-10-15T09:00:00Z",
"received": "2026-10-15T09:00:00Z",
"points": 0,
"maximumPoints": 0,
"score": null,
"deviations": null,
"requiresValidation": false,
"approval": null,
"disapproval": null
}Assignments. target is the Location. status and definitionState differ. attachments contains attachment references; activities contains typed history objects when present.
{
"id": "assignments/1847225-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"name": "Check the gate sensor",
"externalId": "TICKET-4711",
"description": "Inspect before opening.",
"definition": null,
"definitionState": null,
"start": null,
"end": null,
"priority": false,
"definitionPriority": null,
"status": "Created",
"target": "locations/345678-A",
"asset": null,
"assignees": [
"usergroups/2233-A"
],
"creator": "users/123456-A",
"categories": [],
"definitionCategories": [],
"attachments": [],
"activities": []
}Notes. type is a string (a fictional value is shown here). approval is a Note approval object when present. deleted/deletedBy describe deletion metadata.
{
"id": "notes/100-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"description": "Inspection handover.",
"type": "example-type",
"organization": "organizations/100-A",
"location": "locations/345678-A",
"assignment": null,
"createdBy": "users/123456-A",
"updatedBy": null,
"deleted": null,
"deletedBy": null,
"requiresApproval": false,
"approval": null
}Downtimes. duration is recorded minutes and may be null. state is Open, Blocking, Resolved or Closed. This snapshot does not include the full operational timeline.
{
"id": "downtimes/100-A",
"created": "2026-01-01T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"description": "Gate sensor inspection.",
"organization": "organizations/100-A",
"location": "locations/345678-A",
"assignment": null,
"duration": null,
"state": "Open",
"categories": []
}Dispatches. Numbers can be null. source identifies the recording source. This example is external Other; native entries do not populate utilization here.
{
"id": "locations/345678-A|2026-10-15T09:00:00.0000000Z|Other",
"created": "2026-10-15T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"source": "Other",
"location": "locations/345678-A",
"organization": "organizations/100-A",
"when": "2026-10-15T09:00:00Z",
"riders": 22,
"dispatchUnitCapacity": 24,
"dispatchUnitsAvailable": 1,
"totalUnavailableCapacity": 0,
"dispatchUnitCapacityAvailable": 24,
"dispatchDelayReason": null,
"utilization": 91.7
}QueueTimes. queueTimeInMinutes is minutes; queueSize is the queue count when supplied. Native queue entries leave queueSize null.
{
"id": "locations/345678-A|2026-10-15T09:00:00.0000000Z|Other",
"created": "2026-10-15T09:00:00Z",
"updated": "2026-10-15T09:00:00Z",
"isDeleted": false,
"source": "Other",
"location": "locations/345678-A",
"organization": "organizations/100-A",
"when": "2026-10-15T09:00:00Z",
"queueTimeInMinutes": 15,
"queueSize": 80
}Process changes and deletions
Use resource, event, data.id and timestamp together to detect repeat deliveries. Persist accepted work before returning a 2xx within five seconds; process it asynchronously. Reject invalid signatures. Do not fetch a deleted record as a prerequisite for handling its deletion.
Notifications can arrive out of order. Retain ordering metadata and deletion markers, and reconcile conflicting updates. For Dispatches and QueueTimes, when identifies the original entry time; a deletion advances updated and clears measurement fields to null. Keep the composite ID intact.
Treat nested objects as structured data, not display strings. Results approval/deviation objects and Assignment activities have additional type-specific fields. Preserve them and validate your required fields against captured test deliveries; the examples do not enumerate every nested variant.
Best practices
Keep raw accepted payloads under your retention policy; they can contain personal data.
Read fields by name; tolerate additive fields and handle unknown resource/type values explicitly.
Use the public API with a read-only key when you need more record details; handle 401, 403, 404 and rate limits using the error guide.
Frequently asked questions
Can a webhook include names instead of IDs?
Not as a configurable replacement. Many relationships are IDs. Resolve them with the public API or a local lookup table; the snapshot may include the record’s own name.
How do I filter Assignment webhooks for one group?
Use the User Group ID in a tested Regex, not its display name. Regex is matched against the serialized envelope. Invalid or slow patterns send nothing. See webhook setup and filters.
Why did a new Dispatch arrive as Updated?
Dispatches and QueueTimes support Updated and Deleted. New operational entries are sent as Updated; subscribing for Created will not capture them.
Why is a Deleted User payload marked isDeleted: false?
The User can be removed from your organization while their account remains in another organization. Treat the Deleted event as removal from your organization; do not ignore it because the flag is false.