> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.thepennyinc.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server.

# user.created

POST 

Sent when a `user.created` event occurs.

Reference: https://docs.thepennyinc.com/api-reference/penny-banking/webhook-payloads/user/user-created-webhook

## Request

### Payload

- `event_id` (string, required) — Penny's unique identifier for this notification event.
- `business_id` (string, required) — The business the event belongs to. When the event originated from a different business, this contains the originating business.
- `type` ("user.created", required) — The notification event type. This identifies the specific occurrence represented by the event and determines how its data should be interpreted.
- `category` ("object", required) — The category of the event payload. This groups related notification event types and describes the general kind of data contained in ``data``.
- `schema_version` ("1.0", required) — The version of the JSON notification event schema used to encode this webhook payload.
- `event_time` (datetime, required) — The date and time Penny generated the notification event.
- `occurrence_time` (datetime, required) — The date and time the underlying occurrence represented by this notification event took place.
- `data` (WebhooksUserCreatedWebhookPayloadContentApplicationJsonSchemaData, required) — A notification about a domain object being created, updated, or deleted.

## Types

### WebhooksUserCreatedWebhookPayloadContentApplicationJsonSchemaData

A notification about a domain object being created, updated, or deleted.

- `operation` (enum, required) — The change that produced this event: 'created', 'updated', or 'deleted'.
  - Allowed values: `created`, `updated`, `deleted`
- `subject` (ObjectReferenceResponse, required) — The object this event concerns.
- `category` ("object", optional, default: object) — Identifies this payload as an object change.
- `object` (WebhooksUserCreatedWebhookPayloadContentApplicationJsonSchemaDataObject, optional)
- `previous_attributes` (map from string to any, optional, nullable) — The object's attributes before this change, if included.

### ObjectReferenceResponse

A pointer to the object this event concerns.

- `object_type` (string, required) — The kind of object this event concerns.
- `object_id` (string, required) — The unique identifier of the object this event concerns.
- `version` (integer, optional, nullable) — The object's version at the time of this event, if known.
- `stage` (integer, optional, nullable) — The object's lifecycle stage at the time of this event, if applicable.

### WebhooksUserCreatedWebhookPayloadContentApplicationJsonSchemaDataObject

- BusinessUserWebhookPayload: BusinessUserWebhookPayload
- CardholderUserWebhookPayload: CardholderUserWebhookPayload

### BusinessUserWebhookPayload

A business user, as delivered in webhook event payloads.

- `user_id` (string, required) — Penny's unique identifier for this user.
- `version` (integer, required) — A number that increases each time this user's details change. Use it to confirm you are looking at the latest information.
- `version_time` (datetime, required) — The date and time this user's details were last changed.
- `created_time` (datetime, required) — The date and time this user was created.
- `status` (enum, required) — The user's current lifecycle status: 'active', 'deactivated' (cannot sign in), 'suspended' (restricted, typically pending review), or 'deleted'.
  - Allowed values: `active`, `deactivated`, `suspended`, `deleted`
- `active` (boolean, required) — Whether this user's account is currently active.
- `business_id` (string, required) — The business this user belongs to.
- `given_name` (string, required) — The user's given (first) name. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `family_name` (string, required) — The user's family (last) name. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `email` (string, required) — The user's primary email address. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `nickname` (string, optional, nullable) — The user's preferred nickname, if they have set one. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `phone` (string, optional, nullable) — The user's phone number, if one is on file. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `address` (AddressResponse, optional, nullable) — The user's physical address, if one is on file. Street lines and postal code are masked unless the request explicitly asks to reveal personal information; city, state or province, and country remain visible.
- `roles` (list of RolePointerResponse, optional, nullable) — The roles assigned to this user, if any.
- `type` (enum, optional, default: business) — Discriminates the variant of a user account.
  - Allowed values: `business`, `cardholder`
- `permissions` (list of ClientWebhookPermissionResponse, optional, nullable) — Permissions granted directly to this user, in addition to any granted through its roles.

### CardholderUserWebhookPayload

A cardholder user, as delivered in webhook event payloads.

- `user_id` (string, required) — Penny's unique identifier for this user.
- `version` (integer, required) — A number that increases each time this user's details change. Use it to confirm you are looking at the latest information.
- `version_time` (datetime, required) — The date and time this user's details were last changed.
- `created_time` (datetime, required) — The date and time this user was created.
- `status` (enum, required) — The user's current lifecycle status: 'active', 'deactivated' (cannot sign in), 'suspended' (restricted, typically pending review), or 'deleted'.
  - Allowed values: `active`, `deactivated`, `suspended`, `deleted`
- `active` (boolean, required) — Whether this user's account is currently active.
- `business_id` (string, required) — The business this user belongs to.
- `given_name` (string, required) — The user's given (first) name. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `family_name` (string, required) — The user's family (last) name. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `email` (string, required) — The user's primary email address. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `cardholder_id` (string, required) — The cardholder record this user is linked to. Access through this user is scoped to that cardholder's own cards and transaction history.
- `nickname` (string, optional, nullable) — The user's preferred nickname, if they have set one. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `phone` (string, optional, nullable) — The user's phone number, if one is on file. Shown as a masked placeholder unless the request explicitly asks to reveal personal information.
- `address` (AddressResponse, optional, nullable) — The user's physical address, if one is on file. Street lines and postal code are masked unless the request explicitly asks to reveal personal information; city, state or province, and country remain visible.
- `roles` (list of RolePointerResponse, optional, nullable) — The roles assigned to this user, if any.
- `type` (enum, optional, default: cardholder) — Discriminates the variant of a user account.
  - Allowed values: `business`, `cardholder`
- `permissions` (list of ClientWebhookPermissionResponse, optional, nullable) — Permissions granted directly to this user, in addition to any granted through its roles.

### AddressResponse

External API representation of a physical address. Country is normalized to ISO 3166-1 alpha-2. State/province is normalized to its subdivision code where applicable.

- `line_1` (string, required) — Primary address line.
- `city` (string, required) — City or locality.
- `zip_code` (string, required) — Postal or ZIP code.
- `country` (string, required) — Country in ISO 3166-1 alpha-2 format.
- `line_2` (string, optional, nullable) — Secondary address line.
- `state_or_province` (string, optional, nullable) — State or province code (if applicable).

### RolePointerResponse

A reference to a role assigned to a user or application.

- `role_id` (string, required) — The assigned role's ID: `role_…` for custom roles, `global_role_…` for preset roles.
- `role_type` (enum, required) — Whether this is a custom role owned by your business (`business`) or a preset role Penny provides for every business (`global`).
  - Allowed values: `business`, `global`

### ClientWebhookPermissionResponse

A permission specifying the resource and action a user or application can access.

- `resource` (enum, required) — The resource type this permission applies to.
  - Allowed values: `business`, `sub_business`, `business_entity`, `business_defaults`, `user`, `role`, `permission`, `application`, `verification`, `account`, `ledger`, `transaction`, `card`, `cardholder`, `card_product`, `bin`, `spend_control`, `simulation`, `fee`, `program`, `task`, `notification_endpoint`, `notification_event`, `notification_decision_exchange`, `*`
- `action` (enum, required) — The action permitted on the resource.
  - Allowed values: `read`, `list`, `create`, `update`, `delete`, `execute`, `reveal`, `*`