Events

Every relevant change in Cord produces an event: a record with a type, an object, data and who caused it. The same events are delivered to your webhooks, trigger Cord Workflows and stay in a history you query with GET /api/v1/events, whether or not any endpoint is subscribed.

Event catalog

There are 41 types. The Object column is the value of object in the history and determines the shape of data (see the next section).

ping isn’t a catalog event: it’s the test delivery from the Workbench’s Test button and never shows up in the history.

Shape of data per object

Every amount travels with its currency in moneda. Field names are the server’s, in Spanish.

Extra fields per event:

On an invoice, estado is its lifecycle (draft, open, paid, void or uncollectible) and estado_fiscal its registration with the tax provider (pending, issued, cancelled or error). On a quote, status is draft, sent, viewed, approved, rejected, expired, invoiced or paid.

The data stored in the history is the webhook’s without link_publico: the link is a client credential and isn’t stored.

Who caused the event: actor

Treat actor as text with a prefix: decide by what comes before the colon and don’t assume the list won’t grow.

History: GET /api/v1/events

Returns your organization’s events, newest first. If your server was down longer than the retries cover, this is where you recover what you missed.

curl "https://cordhq.app/api/v1/events?object_id=8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10&limit=10" \
  -H "Authorization: Bearer sk_test_..."

import { Cord } from '@flouviahq/node';

const cord = new Cord(process.env.CORD_API_KEY);
const page = await cord.events.list({ object_id: '8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10', limit: 10 });
for (const event of page.data) console.log(event.created_at, event.type, event.actor);

{
  "data": [
    {
      "id": "e81c5a3f-7d2b-4e9a-b6c1-0f4d8a2e5c71",
      "type": "quote.approved",
      "object": "quote",
      "object_id": "8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10",
      "data": {
        "id": "8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10",
        "folio": "COT-0001",
        "status": "approved",
        "moneda": "MXN",
        "total": 13920,
        "cliente": "Ferretería La Prueba",
        "cliente_id": "0e6f2b8a-91c4-4d7e-b3a5-6c2d8f1e4a90"
      },
      "actor": "client",
      "created_at": "2026-10-07T17:31:44.208Z"
    },
    {
      "id": "3a7f1c9e-2b4d-4a6e-8c0f-5d9b3e7a1c24",
      "type": "quote.sent",
      "object": "quote",
      "object_id": "8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10",
      "data": {
        "id": "8b0c6f0e-2d55-4c1e-9a43-6a2f1c7d9e10",
        "folio": "COT-0001",
        "status": "sent",
        "moneda": "MXN",
        "total": 13920,
        "cliente": "Ferretería La Prueba",
        "cliente_id": "0e6f2b8a-91c4-4d7e-b3a5-6c2d8f1e4a90"
      },
      "actor": "api:2c6e0a9d-4f1b-4c3e-8a7d-9b5f1e3c7a20",
      "created_at": "2026-10-07T17:04:12.318Z"
    }
  ],
  "meta": { "next_cursor": null }
}

• The history’s id is the record’s own UUID. It is not the evt_… of the webhook delivery: to deduplicate across the two, use object_id plus type plus created_at.
• object_id is null for events without an object that has a UUID, such as account.updated.
• Pagination is by cursor and stable: a new event doesn’t shift the page you’re reading. See Pagination.
• An object_id that isn’t a UUID or an invalid cursor returns 400 with code: "invalid_request".

Retention

The history is append-only: an event isn’t edited after it’s written. It’s kept for 90 days and then a daily process deletes it; an event that started a workflow run is kept as long as that run exists, and a run is deleted one year after it finishes. The webhook delivery log has its own period (30 days; 90 for failed ones). Everything is deleted along with the organization.

Verify a key: GET /api/v1/me

It’s the simplest call in the API: it confirms the key is valid and says which organization it belongs to, its permission and its mode. It answers with any secret key, restricted key or OAuth connection, regardless of per-resource permissions.

curl https://cordhq.app/api/v1/me \
  -H "Authorization: Bearer sk_test_..."

import { Cord } from '@flouviahq/node';

const cord = new Cord(process.env.CORD_API_KEY);
const me = await cord.me();
console.log(me.org.nombre, me.scope, me.mode);

{
  "data": {
    "org": { "id": "5b1f7d9e-3c2a-4e8b-9f61-0a7c4d2e8b13", "nombre": "Aceros del Norte", "plan": "pro" },
    "scope": "write",
    "mode": "test"
  }
}

Use it to test a credential before saving it in your integration.