Webhooks

User events

Two events that fire when a LinkedIn connection is formed — carrying the new contact's profile fields in a single delivery. Both are polled, not real-time.

Early access — connection.new

connection.new is newly wired on the current platform substrate. The delivery envelope is stable and safe to build against — the top-level event plus the data object, which always carries account_id and occurred_at. Individual data field shapes may still be refined as live validation completes, so pin your handler to the envelope and treat per-field additions as backward-compatible.

Quick reference

EventAvailabilityDescription
connection.acceptednot_realtime (~8h)A pending invitation you sent was accepted by the recipient.
connection.newnot_realtime (~4h) · opt-inAny new relation appeared on the account — not just ones you invited.

Subscribe to receive connection events when creating your webhook. The default event is connection.accepted; connection.new is opt-in and must be named explicitly:

curl -X POST https://api.curviate.com/v1/webhooks \
  -H "Authorization: Bearer cvt_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "user",
    "request_url": "https://hooks.example.com/curviate",
    "account_ids": ["acc_YOUR_ACCOUNT_ID"],
    "events": ["connection.accepted"]
  }'

connection.accepted

Fired when a pending connection invitation sent from a connected account is accepted by the recipient. Once received, the two members are connected and messaging is available without InMail credits.

Delivery timing — up to 8 hours

connection.accepted is not real-time. LinkedIn relationship state is polled on a schedule, so delivery of this event may be delayed by up to 8 hours after the recipient accepts. This is a platform constraint, not a Curviate bug. Design your workflow to be tolerant of this delay — do not build logic that expects sub-second or even sub-minute delivery of connection events.

{
  "id":          "wdl_YOUR_DELIVERY_ID",
  "webhook_id":  "wh_YOUR_WEBHOOK_ID",
  "event":       "connection.accepted",
  "data": {
    "account_id": "acc_YOUR_ACCOUNT_ID",
    "user": {
      "full_name":         "Alex Jordan",
      "provider_id":       "urn:li:member:123456789",
      "public_identifier": "alexjordan",
      "profile_url":       "https://www.linkedin.com/in/alexjordan",
      "picture_url":       "https://media.licdn.com/dms/image/example/photo.jpg"
    },
    "occurred_at": "2026-05-28T16:45:00.000Z"
  },
  "delivered_at": "2026-05-29T00:45:01.012Z"
}

Notable fields

  • data.user.full_name — the new connection's display name on LinkedIn.
  • data.user.provider_id — the LinkedIn member URN (e.g. urn:li:member:123456789).
  • data.user.public_identifier — the LinkedIn vanity URL slug (e.g. alexjordan from linkedin.com/in/alexjordan).
  • data.user.profile_url — direct link to the connection's public profile.
  • data.user.picture_url — profile photo URL; may be absent when the member has no public photo.
  • data.occurred_at — when the connection was formed on LinkedIn. Due to the polling constraint, delivered_at may be significantly later than occurred_at.

connection.new

Fired when any new relation appears on the connected account — any new LinkedIn connection, not just ones you invited. It is a superset of connection.accepted. connection.new is opt-in — name it in events[] to receive it.

Not real-time + first-connect backfill burst

connection.new carries availability: "not_realtime". LinkedIn relationship state is polled, so delivery may lag the real event by up to ~4 hours. Additionally, a freshly connected account may receive a backfill burst of connection.new events for its pre-existing network during the initial-sync window — build for volume tolerance, not sub-minute delivery. This is a platform polling constraint, not a Curviate bug.

connection.new delivers the same data shape as connection.accepted. data.account_id is always present — sourced from the delivery — so scope your handler on it.

{
  "id":          "wdl_YOUR_DELIVERY_ID",
  "webhook_id":  "wh_YOUR_WEBHOOK_ID",
  "event":       "connection.new",
  "data": {
    "account_id": "acc_YOUR_ACCOUNT_ID",
    "user": {
      "full_name":         "Sam Rivera",
      "provider_id":       "urn:li:member:246813579",
      "public_identifier": "samrivera",
      "profile_url":       "https://www.linkedin.com/in/samrivera",
      "picture_url":       "https://media.licdn.com/dms/image/example/photo.jpg"
    },
    "occurred_at": "2026-05-28T18:00:00.000Z"
  },
  "delivered_at": "2026-05-28T22:00:01.500Z"
}

Tracking new followers

follower.new is not a webhook event

Curviate does not offer a follower.new webhook event — new-follower activity is not deliverable as a webhook. To track followers, poll instead: read the account's followers or use the followers_of search filter (see the API reference). Naming follower.new in a webhook's events array is rejected like any unknown event with 400 INVALID_REQUEST.

Field remapping

When creating a user-source webhook you can include a data array to control which fields appear in the delivered data object. The 9 available keys for the user source:

account_id        account_type      webhook_name
timestamp         user_provider_id  user_full_name
user_public_identifier  user_profile_url  user_picture_url

When data is omitted the default payload shape documented above is delivered.

COMPANY · LEGAL

Privacy Policy

Redmer Holding GmbHLast updated July 25, 2026

Who we are

Curviate is operated by Redmer Holding GmbH ("Curviate", "we", "us"), a German GmbH registered at Amtsgericht Bonn, HRB 29957, registered address Hostertstraße 16, 53332 Bornheim, Germany. Full company details are on our Imprint. We haven't appointed a statutory Data Protection Officer, since our processing doesn't reach the scale or sensitivity that requires one. Privacy questions go to privacy@curviate.com.

The two roles we play

When you create an account and use Curviate, we process your own data (identity, billing, API keys, connector authorizations). For that data, we are the controller.

When you use Curviate to act on your own connected LinkedIn account, viewing profiles, sending messages, managing engagement, that content and those contacts belong to that account and its people. You are the controller of that data; we are the processor, acting only on your instructions, under the Data Processing Agreement between us. If one of your contacts has a question about being reached through Curviate, you're who they should contact first; email privacy@curviate.com if you need help routing it.

What we collect, and why

DataWhy
Account identity (name, email, sign-in method)Create and secure your account
Your LinkedIn credentialsOperate the actions you request
LinkedIn content returned by an API callFulfil that specific request, nothing more
API keys and connector (OAuth) authorizationsAuthenticate your API, CLI, MCP, or SDK requests
Billing detailsCharge you correctly and meet our tax obligations
Usage and security logsKeep the service reliable and abuse-free
Support messagesRespond to you
Website analytics, only if you opt inUnderstand how the site is used

We rely on our contract with you, our legitimate interest in running and securing the service, our legal obligations (tax law, for example), and, for analytics, your consent. We never sell your data or use it to train models.

Where it's processed, and who else touches it

Our infrastructure runs in the EU. Hosting: Railway. Database and auth: Supabase, Ireland. Email: Resend. Payments: Stripe. Network security: a DDoS-protection provider sits in front of our app and never sees or stores request content. LinkedIn connectivity: a third-party infrastructure provider that lets us execute LinkedIn actions on your behalf. Error tracking: Sentry, Frankfurt. Product analytics: PostHog, Frankfurt. Uptime monitoring: Better Stack.

We give the current, named list of every provider above, plus our Data Processing Agreement, to any customer who asks: security@curviate.com.

Outside the EU

All customer LinkedIn data, account data, and telemetry are processed and stored exclusively in EU regions of our sub-processors. A few providers we rely on (Stripe and Sentry, for example) are headquartered outside the EU/EEA; where that applies, it's covered by their own GDPR safeguards, typically the EU Standard Contractual Clauses.

How long we keep it

DataRetention
Account and workspace dataWhile your account is active
Closed accountRecoverable for 7 days, then deleted on day 8
LinkedIn credentialsUntil you disconnect that account
LinkedIn contentNot stored; any transient cache clears within 1 hour, never indexed, never used for training
API keysUntil you revoke or rotate them
Connector (OAuth) authorizationsAccess token ~1 hour; refresh token up to ~12 months, or until you revoke it, whichever comes first
Billing recordsAs required by German tax law, currently up to 10 years
LogsA short operational window; metadata only, never message content

The 12-month figure above is a server-side credential for a connected AI agent or app. It is not a cookie and doesn't touch your browser session; see Cookies below for that. You can see and revoke every connector from Authorized applications in your dashboard at any time.

Cookies

We keep cookies to a minimum, and ask before anything beyond the essentials runs.

Strictly necessary, no consent needed:

NamePurposeExpiry
cc_cookieRemembers your cookie choice12 months
curviate-themeRemembers light/dark mode (local storage, not a cookie)Persistent
sb-*-auth-tokenKeeps you signed inWhile active; cleared on sign-out

Analytics, only if you accept:

NamePurposeExpiry
_gaGoogle Analytics: distinguishes visitors2 years
_gidGoogle Analytics: distinguishes visitors24 hours
_ga_<container id>Google Analytics: persists session state2 years

No advertising cookies, ever. Accept and reject are equally easy, and you can change your mind any time via Cookie Preferences in the footer; we won't ask again for 12 months unless something material changes. Our LinkedIn connect flow and OAuth authorization screen never set anything beyond the essentials, so no banner appears there.

Connecting an AI agent or app

Curviate is built for AI agents and automated clients as much as for people. If you connect an app like Claude, or your own code, via an API key or an OAuth connector, it can act on your workspace within the access you gave it. What it does with anything it receives back, including what it sends to its own AI model, is between you and that provider; review its practices before connecting it. Review and revoke any connection any time from your dashboard.

Your rights

You can access, correct, delete, restrict, or object to your data, port it elsewhere, and withdraw consent at any time: email privacy@curviate.com. Closing your account starts the 7-day recoverable window above. We don't make automated decisions about you that have a legal or similarly significant effect. You can also complain to a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de, though you're free to complain to the one in your own country instead.

Keeping it secure

Credentials are encrypted and never logged, returned, or shared. LinkedIn actions run through native, humanized flows; full detail is on our Security & Compliance page. If a breach puts your rights at risk, we'll notify the authorities and you, as GDPR requires. Curviate isn't directed at, or offered to, anyone under 16.

Changes

We'll update this page when our practices change, and reset the cookie prompt if the change is material.

Contact