API reference

Version 1.0.0-draft.1 · generated fromopenapi.yaml(JSON). Base URL:https://actions.ahlanhamad.com.

The Ahlan Hamad Partner API lets approved partners (accounting, point-of-sale, banking) integrate with a company's HR and payroll data in Ahlan Hamad.

Status: DRAFT. This contract is published ahead of the implementation so partners can build in parallel. Every operation carries an x-release marker:

Release	Contents
`v1.0`	Company, employees, payroll runs (read)
`v1.1`	Attendance ingest + read-back
`v1.2`	Webhook endpoints + events

Shapes may still change before each release ships; after it ships, v1 only changes additively (new fields, new optional parameters, new enum values, new event types). Clients must ignore unknown fields and tolerate unknown enum values.

Data protection. v1 never returns salaries, allowances per employee, bank details (IBAN), civil ID / passport numbers, dates of birth, social insurance numbers, or documents. Payroll data is available only as run-level totals and journal lines.

Conventions

JSON over HTTPS, UTF-8. Field names are snake_case.
Timestamps are RFC 3339 with an explicit offset (2026-09-29T08:02:11+04:00). Timestamps we return are UTC (Z).
Calendar dates are YYYY-MM-DD; payroll months are YYYY-MM.
Money is a decimal string in the currency's minor-unit precision ("1250.500" KWD/BHD/OMR, "1250.50" SAR/AED/QAR), always paired with an ISO 4217 currency. Never parse money as a float.
IDs are opaque strings. Do not infer structure from them.

Authentication

Authorization: Bearer <key>. Keys are created in Ahlan Hamad under Integrations → API keys by a company user with the integrations.manage permission (CEO or HR admin by default). A key belongs to exactly one company, carries a fixed set of scopes, and is shown once at creation.

ah_live_… keys work only for live companies.
ah_test_… keys work only for sandbox companies (fake data you can build against safely). Using the wrong kind returns 401.

Sandbox, self-serve. Anyone with an Ahlan Hamad login can press Create sandbox company (on /developers or Integrations → API keys) to get a private sandbox company pre-filled with fake employees and one finalized payroll run, then issue ah_test_ keys for it. No contact with Ahlan Hamad is needed to start building.

Scopes: employees:read, payroll:read, attendance:read, attendance:write, webhooks:manage. GET /v1/company needs none.

Company

The company this API key belongs to

GET/v1/companyships in v1.0any valid key

Available to every valid key; no scope required.

Responses

Status	Description	Body
`200`	The company.	Company
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`429`	Too many requests for this key.	Problem

Employees

List employees

GET/v1/employeesships in v1.0scope: employees:read

Returns partner-safe employee records, oldest first. Archived records are never returned. To follow changes, subscribe to the employee.* webhooks (v1.2) instead of polling; there is no updated_since filter in v1.

Parameters

Name	In	Type	Description
`status`	query	string	`active` — currently employed (every status except `left`). `left` — employment has ended. Omit for both. One of: `active`, `left`
`entity_id`	query	string	Only employees of this legal entity (see `Company.entities`).
`limit`	query	integer	Page size. Range: 1–200Default: `50`
`cursor`	query	string	Opaque `next_cursor` from the previous page. Omit for the first page.

Responses

Status	Description	Body
`200`	A page of employees.	Page + object
`400`	Malformed request (bad query parameter, invalid JSON, unknown cursor).	Problem
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`429`	Too many requests for this key.	Problem

Get one employee

GET/v1/employees/{employee_id}ships in v1.0scope: employees:read

Parameters

Name	In	Type	Description
`employee_id`required	path	string

Responses

Status	Description	Body
`200`	The employee.	Employee
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem
`429`	Too many requests for this key.	Problem

Payroll

List closed payroll runs

GET/v1/payroll-runsships in v1.0scope: payroll:read

Returns only runs that are finalized or paid, newest month first. Draft runs are never exposed. A company that pays in several countries has one run per country (and legal entity) per month.

Parameters

Name	In	Type	Description
`from`	query	Month	First payroll month to include (inclusive).
`to`	query	Month	Last payroll month to include (inclusive).
`status`	query	string	One of: `finalized`, `paid`
`limit`	query	integer	Page size. Range: 1–200Default: `50`
`cursor`	query	string	Opaque `next_cursor` from the previous page. Omit for the first page.

Responses

Status	Description	Body
`200`	A page of payroll runs (summary form).	Page + object
`400`	Malformed request (bad query parameter, invalid JSON, unknown cursor).	Problem
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`429`	Too many requests for this key.	Problem

Get a closed payroll run with its components and journal

GET/v1/payroll-runs/{payroll_run_id}ships in v1.0scope: payroll:read

Run totals, a breakdown by pay component (each with the number of employees it applies to), and the double-entry journal Ahlan Hamad posted for the run. No per-employee amounts are returned.

Parameters

Name	In	Type	Description
`payroll_run_id`required	path	string

Responses

Status	Description	Body
`200`	The payroll run.	PayrollRun
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem
`429`	Too many requests for this key.	Problem

Attendance

Push clock events (clock in/out, breaks)

POST/v1/attendance/eventsships in v1.1scope: attendance:write

Submit up to 500 events per request. Each event is processed independently and the response lists one result per event, in the same order as the request.

Idempotent on external_id (per company and source): resending an event you already sent returns duplicate and changes nothing, so it is always safe to retry a request that timed out.

Employee matching. employee_ref identifies the person. Events whose employee cannot be matched are stored, not dropped, with result unmatched_employee: the company's HR team links the person once in Ahlan Hamad and every stored event for them is then processed automatically. You do not need to resend.

Branches. branch_ref is your identifier for the location. An unknown branch never rejects an event — it is stored as given and HR can map it later.

Clock events are paired into shifts in the company's timezone; a shift that crosses midnight belongs to the day it started. Break time is subtracted from worked time.

Request body

Field	Type	Description
`events`required	array of AttendanceEventInput	Up to 500 items

Example:

{
  "events": [
    {
      "external_id": "qompos-sess-8812-in",
      "employee_ref": {
        "type": "external_id",
        "value": "cashier-0042"
      },
      "type": "clock_in",
      "at": "2026-09-29T08:02:11+04:00",
      "branch_ref": "dubai-marina-01",
      "source": "qompos"
    },
    {
      "external_id": "qompos-sess-8812-out",
      "employee_ref": {
        "type": "external_id",
        "value": "cashier-0042"
      },
      "type": "clock_out",
      "at": "2026-09-29T16:31:40+04:00",
      "branch_ref": "dubai-marina-01",
      "source": "qompos"
    }
  ]
}

Responses

Status	Description	Body
`207`	Per-event results, in request order.	object
`400`	Malformed request (bad query parameter, invalid JSON, unknown cursor).	Problem
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`413`	More than 500 events, or body larger than 1 MB.	Problem
`422`	The body is well-formed JSON but fails validation.	Problem
`429`	Too many requests for this key.	Problem

Read back daily attendance

GET/v1/attendanceships in v1.1scope: attendance:read

One record per employee per day, as Ahlan Hamad holds it after pairing clock events. Includes days recorded by other sources (the employee app, manual HR entries) — check sources.

Parameters

Name	In	Type	Description
`from`required	query	string (date)
`to`required	query	string (date)	Inclusive. At most 62 days after `from`.
`employee_id`	query	string
`limit`	query	integer	Page size. Range: 1–200Default: `50`
`cursor`	query	string	Opaque `next_cursor` from the previous page. Omit for the first page.

Responses

Status	Description	Body
`200`	A page of attendance days.	Page + object
`400`	Malformed request (bad query parameter, invalid JSON, unknown cursor).	Problem
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`429`	Too many requests for this key.	Problem

Webhooks

List webhook endpoints registered by this key

GET/v1/webhooksships in v1.2scope: webhooks:manage

Responses

Status	Description	Body
`200`	Endpoints owned by the calling key.	object
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem

Register a webhook endpoint

POST/v1/webhooksships in v1.2scope: webhooks:manage

The response includes the endpoint's signing secret once. Store it; it cannot be retrieved again (rotate by deleting and re-creating). The URL must be https:// on a public host.

Request body

WebhookEndpointInput

Responses

Status	Description	Body
`201`	Created.	WebhookEndpoint + object
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`422`	The body is well-formed JSON but fails validation.	Problem

Get a webhook endpoint

GET/v1/webhooks/{webhook_id}ships in v1.2scope: webhooks:manage

Parameters

Name	In	Type	Description
`webhook_id`required	path	string

Responses

Status	Description	Body
`200`	The endpoint.	WebhookEndpoint
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem

Change URL, events, or re-enable an endpoint

PATCH/v1/webhooks/{webhook_id}ships in v1.2scope: webhooks:manage

Parameters

Name	In	Type	Description
`webhook_id`required	path	string

Request body

Field	Type	Description
`url`	string (uri)
`events`	array of WebhookEventType
`active`	boolean

Responses

Status	Description	Body
`200`	Updated.	WebhookEndpoint
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem
`422`	The body is well-formed JSON but fails validation.	Problem

Delete a webhook endpoint

DELETE/v1/webhooks/{webhook_id}ships in v1.2scope: webhooks:manage

Parameters

Name	In	Type	Description
`webhook_id`required	path	string

Responses

Status	Description	Body
`204`	Deleted. Pending deliveries are cancelled.	—
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem

Send a `ping` event to the endpoint now

POST/v1/webhooks/{webhook_id}/testships in v1.2scope: webhooks:manage

Parameters

Name	In	Type	Description
`webhook_id`required	path	string

Responses

Status	Description	Body
`202`	Queued for immediate delivery.	—
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem

Recent delivery attempts for an endpoint (self-debugging)

GET/v1/webhooks/{webhook_id}/deliveriesships in v1.2scope: webhooks:manage

The last 100 deliveries to this endpoint, newest first: what we sent, when, what your server answered, and whether we will retry. The same log is visible to the company in Ahlan Hamad under Integrations → API keys. Deliveries older than 30 days are removed.

Parameters

Name	In	Type	Description
`webhook_id`required	path	string
`status`	query	string	One of: `succeeded`, `failed`, `pending`

Responses

Status	Description	Body
`200`	Up to 100 deliveries.	object
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem

Send one past event again now

POST/v1/webhooks/{webhook_id}/deliveries/{delivery_id}/redeliverships in v1.2scope: webhooks:manage

Re-sends the original event (same event id, same payload, fresh signature and timestamp) as a new delivery attempt. Works for any delivery in the log, including successful ones, and on an endpoint that was auto-disabled — re-enable it first with PATCH.

Parameters

Name	In	Type	Description
`webhook_id`required	path	string
`delivery_id`required	path	string

Responses

Status	Description	Body
`202`	Queued. The new attempt appears in the deliveries log.	WebhookDelivery
`401`	Missing, malformed, revoked or wrong-environment API key.	Problem
`403`	The key is valid but lacks the required scope (`insufficient_scope`), or the Partner API is not enabled for this company (`api_not_enabled`).	Problem
`404`	No such resource in this company (or not visible to partners, e.g. a draft payroll run).	Problem
`409`	The endpoint is disabled.	Problem

Webhook events

Every delivery is a WebhookEventenvelope whose data depends on the event type. Verify theX-AH-Signature header on every delivery — see theQuickstart.

Event	When	Release
`employee.created`	An employee was added	v1.2
`employee.updated`	A partner-visible field of an employee changed Sent when any field in the `Employee` schema changes. Delivered at least once and possibly late (a nightly reconciliation catches changes made through bulk tools); always re-read the embedded object rather than diffing.	v1.2
`employee.left`	An employee's employment ended	v1.2
`payroll_run.finalized`	A payroll run was closed and its journal posted	v1.2
`payroll_run.paid`	A payroll run was marked paid and its payment journal posted	v1.2
`payroll_run.corrected`	A closed payroll run's amounts changed A correction was applied to a run that was already `finalized` or `paid`. Totals and journal lines may have changed — re-fetch the run with `GET /v1/payroll-runs/{id}`.	v1.2
`payroll_run.deleted`	A finalized payroll run was deleted and its journal reversed	v1.2
`attendance.rejected`	A stored clock event could not become attendance Sent for events that were accepted but later could not be paired into a valid shift (e.g. a clock-out with no clock-in, or a shift over 16 hours), and for events still unmatched to an employee after 72 hours.	v1.2
`ping`	Test event sent by the "send test event" action	v1.2

Schemas

Problem

RFC 9457 (formerly 7807) problem details.

Field	Type	Description
`type`required	string (uri)
`title`required	string
`status`required	integer
`detail`	string
`code`required	string	Stable machine-readable error code. Branch on this, not on `title`. One of: `invalid_request`, `unauthenticated`, `insufficient_scope`, `api_not_enabled`, `not_found`, `conflict`, `payload_too_large`, `validation_failed`, `rate_limited`, `internal_error`
`request_id`required	string
`errors`	array of object	Field-level problems (for `validation_failed`).

Page

Field	Type	Description
`next_cursor`required	string \| null	Pass as `cursor` to get the next page. `null` on the last page.

Month

stringPattern: ^[0-9]{4}-(0[1-9]|1[0-2])$

Money

Decimal string in the currency's minor-unit precision.

stringPattern: ^-?[0-9]+(\.[0-9]{1,3})?$

CountryCode

stringOne of: KW, SA, AE, QA, BH, OM

CurrencyCode

ISO 4217.

string

LocalizedText

Field	Type	Description
`en`required	string
`ar`	string \| null

Company

Field	Type	Description
`id`required	string
`name`required	LocalizedText
`country`required	CountryCode
`currency`required	CurrencyCode
`timezone`required	string	IANA timezone, e.g. `Asia/Kuwait`.
`sandbox`required	boolean	True for sandbox companies (fake data, `ah_test_` keys).
`entities`required	array of Entity	Legal establishments. A company operating in several GCC countries has one per country; each has its own currency and payroll runs.

Entity

Field	Type	Description
`id`required	string
`country`required	CountryCode
`name`required	LocalizedText
`currency`required	CurrencyCode
`primary`required	boolean

Employee

Partner-safe employee record. Salary, bank, ID-document, date-of-birth, insurance-number and exit-reason data are never included.

Field	Type	Description
`id`required	string
`employee_code`required	string \| null	The company's own staff number, if it uses one.
`name`required	LocalizedText
`job_title`required	LocalizedText
`department`required	string
`status`required	string	`notice_period` — resignation or termination recorded, last day not yet reached. `left` — employment has ended (the reason is not exposed). One of: `active`, `probation`, `on_leave`, `suspended`, `notice_period`, `left`
`employment_type`required	string	One of: `full_time`, `part_time`, `contract`
`country`required	CountryCode
`entity_id`	string \| null
`work_location`	null \| object	The branch / site the employee is assigned to, if any.
`manager_id`	string \| null
`email`	string (email) \| null	Contact email on file (usually the work address).
`phone`	string \| null	Contact phone on file, E.164 where available.
`hire_date`required	string (date)
`termination_date`	string (date) \| null
`external_ids`	map of string	Identifiers this person has in partner systems, keyed by partner app (e.g. `{"qompos": "cashier-0042"}`). Only the calling key's own app is included. Available from v1.1.

PayrollRunSummary

Field	Type	Description
`id`required	string
`month`required	Month
`period_start`required	string (date)
`period_end`required	string (date)
`pay_date`	string (date) \| null
`status`required	string	One of: `finalized`, `paid`
`country`required	CountryCode
`entity_id`	string \| null
`currency`required	CurrencyCode
`employee_count`required	integer
`totals`required	object
`last_corrected_at`	string (date-time) \| null	Set if a correction changed this run after it was closed.

PayrollRun

Includes every field of PayrollRunSummary.

Field	Type	Description
`components`required	array of PayrollComponent	Run totals broken down by pay component. Components with a zero total are omitted.
`journal`required	array of JournalEntry	The journal entries Ahlan Hamad posted for this run: the `accrual` leg when the run was finalized, and the `payment` leg once it is marked paid. Each entry balances (sum of debits = sum of credits).

PayrollComponent

Field	Type	Description
`type`required	string	New types may be added; treat unknown values as "other". `eosb_accrual` and `wps_bank_fees` appear once end-of-service accrual and wage-protection fees are included in the payroll journal. One of: `basic_salary`, `housing_allowance`, `transport_allowance`, `social_allowance`, `other_allowances`, `overtime`, `additions`, `absence_deductions`, `leave_deductions`, `loan_deductions`, `other_deductions`, `employee_social_insurance`, `employer_social_insurance`, `employer_dews`, `income_tax`, `eosb_accrual`, `wps_bank_fees`, `net_pay`
`total`required	Money
`employee_count`required	integer	Number of employees with a non-zero amount for this component.

JournalEntry

Field	Type	Description
`id`required	string
`leg`required	string	One of: `accrual`, `payment`
`reference`required	string
`date`required	string (date)
`currency`required	CurrencyCode
`status`required	string	One of: `posted`, `reversed`
`description`	LocalizedText
`lines`required	array of JournalLine

JournalLine

Field	Type	Description
`account_code`required	string	Account code in the company's Ahlan Hamad chart of accounts (e.g. `5100`).
`account_name`required	LocalizedText
`account_type`	string	One of: `asset`, `liability`, `equity`, `revenue`, `expense`
`component`	string \| null	The `PayrollComponent.type` this line comes from, when it maps to one.
`debit`required	Money
`credit`required	Money
`memo`	string \| null

EmployeeRef

Field	Type	Description
`type`required	string	`external_id` — your own identifier for the person (recommended). HR links it to the employee once; after that it always matches. `employee_id` — Ahlan Hamad's `Employee.id`. `employee_code` — the company's staff number. `email`, `phone` — matched against the employee's contact details. One of: `external_id`, `employee_id`, `employee_code`, `email`, `phone`
`value`required	string

AttendanceEventInput

Field	Type	Description
`external_id`required	string	Your unique ID for this event. Makes the call idempotent. Max 128 characters
`employee_ref`required	EmployeeRef
`type`required	string	One of: `clock_in`, `clock_out`, `break_start`, `break_end`
`at`required	string (date-time)	When it happened, RFC 3339 with offset. Must not be more than 5 minutes in the future or 35 days in the past.
`branch_ref`	string	Your identifier for the location. Max 128 characters
`source`required	string	Your system's name, fixed per integration (e.g. `qompos`). Pattern: `^[a-z0-9_-]{2,32}$`
`meta`	object	Free-form, stored for support (max 2 KB). Never interpreted.

AttendanceEventResult

Field	Type	Description
`external_id`required	string
`event_id`	string
`status`required	string	`accepted` — stored and matched to an employee. `duplicate` — already received; nothing changed. `unmatched_employee` — stored; will be processed once HR links the person. `rejected` — not stored; see `reason`. One of: `accepted`, `duplicate`, `unmatched_employee`, `rejected`
`reason`	string	Present when `status` is `rejected`. One of: `invalid_timestamp`, `timestamp_out_of_range`, `invalid_type`, `employee_left`, `period_locked`
`detail`	string

AttendanceDay

Field	Type	Description
`employee_id`required	string
`date`required	string (date)
`status`required	string	One of: `present`, `late`, `half_day`, `absent`, `on_leave`, `holiday`
`first_in`	string (date-time) \| null
`last_out`	string (date-time) \| null
`worked_minutes`required	integer
`break_minutes`required	integer
`sources`required	array of string	Where the day's records came from.

WebhookEventType

stringOne of: employee.created, employee.updated, employee.left, payroll_run.finalized, payroll_run.paid, payroll_run.corrected, payroll_run.deleted, attendance.rejected

WebhookEndpointInput

Field	Type	Description
`url`required	string (uri)	`https://` only; private and loopback addresses are refused.
`events`required	array of WebhookEventType
`description`	string	Max 200 characters

WebhookEndpoint

Field	Type	Description
`id`required	string
`url`required	string (uri)
`events`required	array of WebhookEventType
`description`	string \| null
`active`required	boolean	False after 7 days of failed deliveries, or when the API key that owns it is revoked. Re-enable with `PATCH` once fixed.
`disabled_reason`	string \| null	One of: `delivery_failures`, `key_revoked`, `manual`
`created_at`required	string (date-time)
`last_delivery`	null \| object

WebhookDelivery

Field	Type	Description
`id`required	string
`event_id`required	string
`event_type`required	string
`attempt`required	integer	1 for the first try; increments on each retry or redelivery.
`status`required	string	One of: `succeeded`, `failed`, `pending`
`response_status_code`	integer \| null	Your server's HTTP status, or null if the connection failed or timed out.
`response_body_excerpt`	string \| null	First 1 KB of your response body.
`error`	string \| null	Our side of a failure (timeout, DNS, TLS, connection refused).
`duration_ms`	integer \| null
`created_at`required	string (date-time)
`next_attempt_at`	string (date-time) \| null	When we will retry, if we will.
`request`	object	Exactly what we sent.

WebhookEvent

Envelope for every webhook delivery.

Verify every delivery. Each request carries X-AH-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256> where the HMAC is computed with the endpoint's secret over <t>.<raw request body>. Reject if the signature does not match or t is more than 5 minutes from your clock.

Delivery. At least once, not necessarily in order. Deduplicate on id. Respond 2xx within 10 seconds; otherwise we retry after 1 min, 5 min, 30 min, 2 h, 12 h and 24 h. After 7 days of failures the endpoint is disabled and the company owner is emailed.

Field	Type	Description
`id`required	string	Unique event ID.
`type`required	string
`created_at`required	string (date-time)
`company_id`required	string
`livemode`required	boolean	False for sandbox companies.
`data`required	object