# Credential Invitation Status Changed

Delivered when a credential invitation reaches a terminal status: `redeemed`, `expired`, or `revoked`. Creation and code rotation do not emit this event.
This event is opt-in. Existing webhook configurations must enable it in the portal. On `redeemed`, `offer_id` identifies the new credential offer and starts the normal offer lifecycle. Fetch the authoritative invitation metadata through `GET /b2b/v1/credential-invitations/{invitationId}`.

Endpoint: POST credential_invitation.status_changed
Version: 1.2.0

## Header parameters:

  - `X-Webhook-Event` (string, required)
    Event type (same as `event` field in body).

  - `X-Webhook-Signature` (string, required)
    HMAC-SHA256 hex digest of the raw request body. Verifying is **recommended** — see the [Webhooks guide](../guides/webhooks.md#verifying-signatures).

  - `X-Webhook-Timestamp` (string, required)
    Unix timestamp of the event.

  - `X-Webhook-Signature-Previous` (string)
    Present during the 24-hour secret rotation grace period — signature with the previous secret.

## Request fields (application/json):

  - `event` (string, required)
    Event type identifier (same value as the `X-Webhook-Event` header).

  - `tenant_id` (string, required)
    Your organization ID.
    Example: 550e8400-e29b-41d4-a716-446655440000

  - `timestamp` (string, required)
    When the event occurred (RFC 3339 UTC).
    Example: 2026-05-16T10:00:00Z

  - `data` (any, required)
    Slim terminal invitation hint. `offer_id` is present only for `redeemed`.
This object never contains an invitation code, email address, claims, credential values, custom message, or redemption URL. Fetch the current code-free invitation metadata through `GET /b2b/v1/credential-invitations/{invitationId}`.

  - `data.invitation_id` (string, required)
    ID of the credential invitation.

  - `data.status` (any, required)
    Terminal status the invitation reached.

  - `data.offer_id` (string, required)
    ID of the credential offer created by redemption.