> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shieldlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# hre.multi_account.changed

> Read multi-account group detections, membership changes, resolutions and revisions.

`hre.multi_account.changed` describes a group of accounts detected together. Enable it for your site and set **`multiaccount: true`** on the endpoint; the option defaults to false. Contact [support](https://docs.shieldlabs.ai/support.md) to confirm availability for your site before relying on this event. Enabling an endpoint does not replay existing groups.

| `data.action` | Meaning |
| - | - |
| `detected` | A new group or a new active episode |
| `updated` | Members, confidence or rules changed for a continuing group |
| `resolved` | The previous group is absent from a complete new evaluation |

Unchanged groups do not emit repeat transitions. Incomplete source coverage does not emit a false resolution. Resolution does not certify that every former member is safe.

## Group fields

All paths below are inside the event's `data` object. The envelope's `event_id` deduplicates delivery; `cluster_id` identifies the group whose state is changing.

### Identity and state

| Field | Type | Meaning |
| - | - | - |
| `kind` | string | `multi_account`, identifying the group detection |
| `domain` | string | Registered domain to which the accounts and group belong |
| `cluster_id` | string | Persistent identifier of this group; use it to associate updates |
| `action` | string | `detected`, `updated` or `resolved`, as described above |
| `status` | string | `evaluated`: this notification represents a completed evaluation |
| `detected` | boolean | True while the reported group is active; false for a resolution |
| `level` | string or null | `medium` or `high` while active; null for a resolution |

### Members

| Field | Type | Meaning |
| - | - | - |
| `user_hids` | string\[] | Complete sorted list of the group's account identifiers. For a resolution, it identifies the group being resolved |
| `users_count` | integer | Number of entries in `user_hids` |
| `added_user_hids` | string\[] | Members added by this transition; a new detection lists all members here |
| `removed_user_hids` | string\[] | Members removed by this transition; a resolution lists the former members here |
| `members_complete` | boolean | True: the reported member list is complete. This is separate from whether detailed evidence was shortened |

### Revisions and evaluation time

| Field | Type | Meaning |
| - | - | - |
| `revision` | string | Version of this group's transition, encoded as a decimal string to preserve integer precision |
| `previous_revision` | string or null | Prior transition version while the group was active; null for a new active episode |
| `evaluated_at` | string (RFC 3339) | When the group was evaluated; the envelope's `created_at` is when the notification was created |
| `rules_version` | string | Version identifier of the evaluation rules; store it as returned |

Compare revisions numerically, not alphabetically. An Event ID handles duplicate delivery; a revision handles the order of distinct changes to one group.

For plain-language definitions of [`revision`](https://docs.shieldlabs.ai/glossary-integration#revision), [`level`](https://docs.shieldlabs.ai/glossary-integration#level), [`kind`](https://docs.shieldlabs.ai/glossary-integration#kind) and related fields, see the [integration glossary](https://docs.shieldlabs.ai/glossary-integration.md#account-event-results).

### Source and evidence summary

| Field | Type | Meaning |
| - | - | - |
| `source.publication_epoch` | string | Scope for the publication sequence. Keep it with the group ID when tracking revisions |
| `source.publication_version` | string | Identifier of the publication containing this result; preserve it as a decimal string |
| `source.coverage_id` | string | Opaque identifier of the evidence coverage associated with the result; retain it for correlation |
| `evidence_summary.basis_types` | string\[] | Labels describing the kinds of evidence supporting the group |
| `evidence_summary.rules` | string\[] | Names of the evidence rules reported for the result; these are labels, not client-configured thresholds |
| `evidence_summary.detail_truncated` | boolean | True when the detailed evidence was shortened. The `user_hids` member list remains complete |

These fields describe the supplied evidence. They do not add to an identification's Risk Score.

## Example payload

```json theme={null}
{
  "event_id": "7b2c9a31c51d8dd1eef41c900a60b34eb3c170b7",
  "site_id": 101,
  "event_type": "hre.multi_account.changed",
  "schema_version": "2026-10-07",
  "created_at": "2026-10-13T09:05:00Z",
  "data": {
    "kind": "multi_account",
    "domain": "example.com",
    "action": "detected",
    "status": "evaluated",
    "detected": true,
    "level": "high",
    "cluster_id": "11111111-1111-4111-8111-111111111111",
    "revision": "1",
    "previous_revision": null,
    "user_hids": ["account-a", "account-b", "account-c"],
    "added_user_hids": ["account-a", "account-b", "account-c"],
    "removed_user_hids": [],
    "users_count": 3,
    "members_complete": true,
    "evaluated_at": "2026-10-13T09:04:00Z",
    "rules_version": "example-rules-version",
    "source": {
      "publication_epoch": "multiaccount-v1",
      "publication_version": "1",
      "coverage_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    },
    "evidence_summary": {
      "basis_types": ["cookie"],
      "rules": ["cookie"],
      "detail_truncated": false
    }
  }
}
```

The version and source identifiers above are illustrative. Store the values actually received.

A group event has **no `identification_id` and no identification `risk_score`**. Do not send it through a scored-identification handler.

An unambiguous expansion or contraction preserves the cluster ID. Splits or merges can resolve old groups and detect new identities. Keep the highest numeric revision per `(site_id, source.publication_epoch, cluster_id)`; compare decimal revisions with `BigInt` or another UInt64-safe type. Preserve overlapping active groups when one group resolves.

Verify the [webhook signature](https://docs.shieldlabs.ai/api/webhooks.md#verification) before processing. This event uses `schema_version: "2026-10-07"`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.