payslip.finalised: the thing it is about, then what happened to it. Open any event below to see its exact payload.
Subscribe to events
An endpoint’seventTypes accepts three kinds of value, and you can mix them:
Set them when you create the endpoint, or change them later:
PUT /endpoints/{endpointId}/event-typesreplaces the list.POST /endpoints/{endpointId}/event-typesadds to it.DELETE /endpoints/{endpointId}/event-types?eventType=payslip.deleted&eventType=payroll_run.*removes several at once.DELETE /endpoints/{endpointId}/event-types/{eventType}removes one.
GET /event-types returns the same catalogue as this page, so your integration can check it at runtime.
Full and Minimal payloads
Each endpoint chooses apayloadStyle.
Full(the default) puts the whole record indata: the payslip, the employee, the P60. You can act on the event without calling back.Minimalputs only identifiers indata: the kind of record, its id and, when the event is about an employee, the employee’s id.metadata.resourceUrl, when the event has one, says where to fetch the rest with your own API credentials. Choose it if you want to fetch only the fields you use, or always want the current state rather than the state when the event was sent.
Full payload is a snapshot of the record when the event happened. Events can arrive late or out of order, so for the current state fetch metadata.resourceUrl with your own credentials. See Treat a Full payload as a snapshot.
In both styles, payslip.created, payslip.updated, payslip.finalised and the P45 and P60 issued and replaced events also carry metadata.documentUrl: where to download the document itself as a PDF. Call it with your own credentials, exactly as you call resourceUrl. It is an API address, not a presigned link, so it only works for a caller with access to the organisation. Every other event, including payslip.deleted, carries null.
Minimal data and metadata
payloadDowngraded: true, so a very large record never fails to arrive. Fetch it from resourceUrl. Keep payloads in mind if your receiver limits request size: most are well under 20 KB.
Personal data in payloads
AFull payload carries the whole record, and Flow Payroll does not remove sensitive fields from it. Depending on the event, that can include employees’ names, National Insurance numbers, dates of birth, home and email addresses, phone numbers, bank details, passport numbers, pay, tax and deductions. The email events (payslip.emailed, p60.email_failed and the others) carry the address the email was sent to.
What Flow Payroll never sends is a link that works on its own. A presigned download link attached to a payslip email is removed before delivery, and resourceUrl and documentUrl are always API addresses that need your credentials.
A Minimal payload has no names, pay, tax, National Insurance numbers, bank or contact details. Its ids still point to a real employee, so treat it as personal data too.
Once a delivery reaches your receiver, you decide how it is stored, who can see it and how long it is kept. See Protect what you receive.
Versions
Every payload carriesapiVersion, a date such as 2026-10-01. An endpoint keeps the version it was created with until you choose to move it: Flow Payroll never changes an existing endpoint’s payloads for you.
Within a version, changes only ever add to what you receive:
- a new optional field on a payload;
- a new event type;
- a new value in a field documented as open-ended.
Events you can subscribe to
Billing your clients
Connections
Court orders
Emails we send for you
Employees
HMRC notices
HMRC RTI
Holiday and leave
Journals
Leavers
P45s and P60s
Pay run line items
Pay runs
Payments
Payslips
Pensions
Recurring deductions and payments
Reports
Salary settings
Statutory pay
Webhook health
Listed but not sent yet
payroll_run.reopened is listed by GET /event-types with the status Planned. It is kept for reopening a locked pay run, which Flow Payroll cannot do yet, so you cannot subscribe to it and it is never sent.