hre.multi_account.changed

hre.multi_account.changed describes a group of accounts detected together. Enable it for your site and set multiaccount: true on the endpoint; the option defaults to false. Contact support to confirm availability for your site before relying on this event. Enabling an endpoint does not replay existing groups.

`data.action`	Meaning
`detected`	A new group or a new active episode
`updated`	Members, confidence or rules changed for a continuing group
`resolved`	The previous group is absent from a complete new evaluation

Unchanged groups do not emit repeat transitions. Incomplete source coverage does not emit a false resolution. Resolution does not certify that every former member is safe.

Group fields

All paths below are inside the event’s data object. The envelope’s event_id deduplicates delivery; cluster_id identifies the group whose state is changing.

Identity and state

Field	Type	Meaning
`kind`	string	`multi_account`, identifying the group detection
`domain`	string	Registered domain to which the accounts and group belong
`cluster_id`	string	Persistent identifier of this group; use it to associate updates
`action`	string	`detected`, `updated` or `resolved`, as described above
`status`	string	`evaluated`: this notification represents a completed evaluation
`detected`	boolean	True while the reported group is active; false for a resolution
`level`	string or null	`medium` or `high` while active; null for a resolution

Members

Field	Type	Meaning
`user_hids`	string[]	Complete sorted list of the group’s account identifiers. For a resolution, it identifies the group being resolved
`users_count`	integer	Number of entries in `user_hids`
`added_user_hids`	string[]	Members added by this transition; a new detection lists all members here
`removed_user_hids`	string[]	Members removed by this transition; a resolution lists the former members here
`members_complete`	boolean	True: the reported member list is complete. This is separate from whether detailed evidence was shortened

Revisions and evaluation time

Field	Type	Meaning
`revision`	string	Version of this group’s transition, encoded as a decimal string to preserve integer precision
`previous_revision`	string or null	Prior transition version while the group was active; null for a new active episode
`evaluated_at`	string (RFC 3339)	When the group was evaluated; the envelope’s `created_at` is when the notification was created
`rules_version`	string	Version identifier of the evaluation rules; store it as returned

Compare revisions numerically, not alphabetically. An Event ID handles duplicate delivery; a revision handles the order of distinct changes to one group.

Source and evidence summary

Field	Type	Meaning
`source.publication_epoch`	string	Scope for the publication sequence. Keep it with the group ID when tracking revisions
`source.publication_version`	string	Identifier of the publication containing this result; preserve it as a decimal string
`source.coverage_id`	string	Opaque identifier of the evidence coverage associated with the result; retain it for correlation
`evidence_summary.basis_types`	string[]	Labels describing the kinds of evidence supporting the group
`evidence_summary.rules`	string[]	Names of the evidence rules reported for the result; these are labels, not client-configured thresholds
`evidence_summary.detail_truncated`	boolean	True when the detailed evidence was shortened. The `user_hids` member list remains complete

These fields describe the supplied evidence. They do not add to an identification’s Risk Score.

Example payload

{
  "event_id": "7b2c9a31c51d8dd1eef41c900a60b34eb3c170b7",
  "site_id": 101,
  "event_type": "hre.multi_account.changed",
  "schema_version": "2026-10-07",
  "created_at": "2026-10-13T09:05:00Z",
  "data": {
    "kind": "multi_account",
    "domain": "example.com",
    "action": "detected",
    "status": "evaluated",
    "detected": true,
    "level": "high",
    "cluster_id": "11111111-1111-4111-8111-111111111111",
    "revision": "1",
    "previous_revision": null,
    "user_hids": ["account-a", "account-b", "account-c"],
    "added_user_hids": ["account-a", "account-b", "account-c"],
    "removed_user_hids": [],
    "users_count": 3,
    "members_complete": true,
    "evaluated_at": "2026-10-13T09:04:00Z",
    "rules_version": "example-rules-version",
    "source": {
      "publication_epoch": "multiaccount-v1",
      "publication_version": "1",
      "coverage_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    },
    "evidence_summary": {
      "basis_types": ["cookie"],
      "rules": ["cookie"],
      "detail_truncated": false
    }
  }
}

The version and source identifiers above are illustrative. Store the values actually received. A group event has no identification_id and no identification risk_score. Do not send it through a scored-identification handler. An unambiguous expansion or contraction preserves the cluster ID. Splits or merges can resolve old groups and detect new identities. Keep the highest numeric revision per (site_id, source.publication_epoch, cluster_id); compare decimal revisions with BigInt or another UInt64-safe type. Preserve overlapping active groups when one group resolves. Verify the webhook signature before processing. This event uses schema_version: "2026-10-07".

Run a check

Get the result

Account

Contracts

hre.multi_account.changed

Group fields

Identity and state

Members

Revisions and evaluation time

Source and evidence summary

Example payload

​Group fields

​Identity and state

​Members

​Revisions and evaluation time

​Source and evidence summary

​Example payload

Group fields

Identity and state

Members

Revisions and evaluation time

Source and evidence summary

Example payload