customer.anonymized
Shyni sends a POST to your endpoint when this event happens. Before you trust the body, verify the signature.
A customer was anonymized (GDPR erasure by the studio, or the retention job for an inactive customer). Erase your copy of the customer data.id; data is the customer as GET /customers/{id} returns it after the erasure, so it carries no personal data. Sent to the endpoint URL when the event happens. Answer 2xx within 15 seconds. Verify the signature before trusting the body. See the webhooks guide.
Shyni-Signature*stringt=<unix seconds>,v1=<hex>[,v1=<hex>], HMAC-SHA256 of "<t>.<raw body>" keyed with the
endpoint secret. See the webhooks guide.
Shyni-Event-Id*stringSame as the envelope id. Stable across retries, dedupe on it.
Shyni-Event-Type*stringSame as the envelope type.
application/json- body
Webhook body for customer.* events; data is the customer as the REST API returns it.
id*stringtype*stringEvent name, e.g. customer.anonymized.
createdAt*stringdate-timeapiVersion*stringbusinessId*stringThe business (studio) the event happened in - the value sent as Shyni-Business.
data*A customer of the studio. For an erased customer (anonymizedAt set) the personal fields are null or empty;
the order count and dates stay, the orders themselves are kept.
Delivery acknowledged. Any 2xx counts as delivered; the body is ignored.
Example payload
Shyni sends a POST to your endpoint
{ "id": "f3a1c2d4-6b7e-4a80-9c15-0e2d4b6a8017", "type": "customer.anonymized", "createdAt": "2026-10-19T09:15:00Z", "apiVersion": "v1", "businessId": "5d0b8e4a-7c21-4f3e-9a66-1b2c3d4e5f60", "data": { "id": "5e2f8a14-9c73-4b0d-a6e1-3d8b7f2c4a95", "name": null, "email": null, "phone": null, "contacts": [], "subjects": [], "note": null, "externalRef": "crm-cust-88", "orderCount": 3, "firstOrderAt": "2026-03-02T08:00:00Z", "lastOrderAt": "2026-10-09T08:00:00Z", "createdAt": "2026-03-01T10:15:00Z", "anonymizedAt": "2026-10-19T09:15:00Z" }}