Skip to main content
Each event has a type such as payslip.finalised: the thing it is about, then what happened to it. Open any event below to see its exact payload.

Subscribe to events

An endpoint’s eventTypes accepts three kinds of value, and you can mix them: Set them when you create the endpoint, or change them later:
  • PUT /endpoints/{endpointId}/event-types replaces the list.
  • POST /endpoints/{endpointId}/event-types adds to it.
  • DELETE /endpoints/{endpointId}/event-types?eventType=payslip.deleted&eventType=payroll_run.* removes several at once.
  • DELETE /endpoints/{endpointId}/event-types/{eventType} removes one.
Subscribe to what you handle, not to *. Every delivery costs your server a request, and exact types mean an event added in future never reaches code that does not expect it.
GET /event-types returns the same catalogue as this page, so your integration can check it at runtime.

Full and Minimal payloads

Each endpoint chooses a payloadStyle.
  • Full (the default) puts the whole record in data: the payslip, the employee, the P60. You can act on the event without calling back.
  • Minimal puts only identifiers in data: the kind of record, its id and, when the event is about an employee, the employee’s id. metadata.resourceUrl, when the event has one, says where to fetch the rest with your own API credentials. Choose it if you want to fetch only the fields you use, or always want the current state rather than the state when the event was sent.
A Full payload is a snapshot of the record when the event happened. Events can arrive late or out of order, so for the current state fetch metadata.resourceUrl with your own credentials. See Treat a Full payload as a snapshot. In both styles, payslip.created, payslip.updated, payslip.finalised and the P45 and P60 issued and replaced events also carry metadata.documentUrl: where to download the document itself as a PDF. Call it with your own credentials, exactly as you call resourceUrl. It is an API address, not a presigned link, so it only works for a caller with access to the organisation. Every other event, including payslip.deleted, carries null.
Minimal data and metadata
A Full payload over 256 KB is sent as Minimal instead, with payloadDowngraded: true, so a very large record never fails to arrive. Fetch it from resourceUrl. Keep payloads in mind if your receiver limits request size: most are well under 20 KB.

Personal data in payloads

A Full payload carries the whole record, and Flow Payroll does not remove sensitive fields from it. Depending on the event, that can include employees’ names, National Insurance numbers, dates of birth, home and email addresses, phone numbers, bank details, passport numbers, pay, tax and deductions. The email events (payslip.emailed, p60.email_failed and the others) carry the address the email was sent to. What Flow Payroll never sends is a link that works on its own. A presigned download link attached to a payslip email is removed before delivery, and resourceUrl and documentUrl are always API addresses that need your credentials. A Minimal payload has no names, pay, tax, National Insurance numbers, bank or contact details. Its ids still point to a real employee, so treat it as personal data too. Once a delivery reaches your receiver, you decide how it is stored, who can see it and how long it is kept. See Protect what you receive.

Versions

Every payload carries apiVersion, a date such as 2026-10-01. An endpoint keeps the version it was created with until you choose to move it: Flow Payroll never changes an existing endpoint’s payloads for you. Within a version, changes only ever add to what you receive:
  • a new optional field on a payload;
  • a new event type;
  • a new value in a field documented as open-ended.
Write your receiver to ignore fields and values it does not know. Anything that would break a receiver (renaming or removing a field, changing its type or meaning) only ever arrives in a new version, served alongside the old one. Event types are never renamed: a replacement is a new type, and the old one is deprecated with a date.

Events you can subscribe to

Billing your clients

Connections

Court orders

Emails we send for you

Employees

HMRC notices

HMRC RTI

Holiday and leave

Journals

Leavers

P45s and P60s

Pay run line items

Pay runs

Payments

Payslips

Pensions

Recurring deductions and payments

Reports

Salary settings

Statutory pay

Webhook health

Listed but not sent yet

payroll_run.reopened is listed by GET /event-types with the status Planned. It is kept for reopening a locked pay run, which Flow Payroll cannot do yet, so you cannot subscribe to it and it is never sent.