Event catalogue

Subscribe a webhook endpoint to one or more of these events on the Webhooks dashboard. The payload shape under data is documented per event below; the outer envelope (id, type, created_at, guild_id, livemode) is the same for every event — see Webhooks.

Moderation

case.created

A moderation case (warn, kick, ban, timeout, mute, note) was opened.

{
  "case_id": 12345,
  "case_number": 87,
  "type": "warn",
  "user_id": "234567890123456789",
  "moderator_id": "345678901234567890",
  "reason": "Posting referral spam",
  "source": "dashboard"
}

source is one of dashboard, api, bot, sync (cross-server replicator).

case.updated

A case was edited (notes added, expiry changed, reason updated).

case.deleted

A case was deleted.

case.appealed

A user submitted an appeal via the public appeal portal.

{
  "case_id": 12345,
  "appeal_id": 9876,
  "user_id": "234567890123456789",
  "message": "I'm really sorry, can you give me another chance…"
}

case.appeal_decided

Staff approved or denied an appeal.

Member lifecycle

member.joined

A member joined the guild.

{
  "user_id": "234567890123456789",
  "username": "alice",
  "account_age_days": 712,
  "is_bot": false,
  "invite_code": "abc123"
}

member.left

A member left or was kicked.

member.banned

A member was banned. Fired in addition to case.created when the ban was actioned by Phantom; fired alone when an out-of-band native Discord ban was detected by audit log.

member.unbanned

A ban was lifted.

Tickets

ticket.opened

A new ticket was opened.

{
  "ticket_id": 4242,
  "number": 318,
  "opener_id": "234567890123456789",
  "ticket_type_id": 5,
  "subject": "Refund request",
  "channel_id": "456…"
}

ticket.message

A new message was added to a ticket (either by the opener or by staff).

ticket.claimed

A staff member claimed a ticket.

ticket.closed

A ticket was closed.

{
  "ticket_id": 4242,
  "closed_by_id": "345678901234567890",
  "close_reason": "Refund processed via Stripe",
  "close_source": "staff_command",
  "duration_seconds": 1843
}

ticket.reopened

A closed ticket was reopened.

Levelling

xp.level_up

A member crossed a level boundary.

{
  "user_id": "234567890123456789",
  "old_level": 9,
  "new_level": 10,
  "total_xp": 6850
}

Economy

economy.balance_changed

A wallet balance changed. Fires for every delta — message earnings, daily claims, transfers, admin adjustments, casino bets/payouts.

{
  "user_id": "234567890123456789",
  "delta": 500,
  "balance": 12300,
  "reason": "Tournament prize",
  "source": "api"
}

source: message_earn | voice_earn | daily | transfer | casino | admin | api.

Engagement

giveaway.created

A giveaway was scheduled.

giveaway.ended

A giveaway ended and winners were drawn.

{
  "giveaway_id": 1234,
  "winner_ids": ["234…", "345…", "456…"],
  "entry_count": 482
}

giveaway.rerolled

A giveaway was rerolled (winners re-drawn).

Security

security.raid_detected

The anti-raid module flagged a coordinated join event.

{
  "raid_id": 88,
  "joins_in_window": 23,
  "window_seconds": 30,
  "action_taken": "quarantine"
}

security.scam_detected

The anti-scam vision scan flagged a message as a phishing image.

security.nuke_detected

The anti-nuke module flagged a mass-destruction event.

security.audit_entry

A security audit entry was recorded (permission changes, settings changes, security-sensitive admin actions).

network.hit

A Phantom Network hit fired against a member who joined or is already in your guild.

{
  "user_id": "234567890123456789",
  "trust_score": 12,
  "approved_report_count": 7,
  "top_category": "scams",
  "top_severity": "high",
  "summary": "Repeated nitro scam DMs across 5 servers."
}

Automod

automod.triggered

An automod rule matched a message.

{
  "rule_id": 18,
  "category": "links",
  "user_id": "234567890123456789",
  "channel_id": "456…",
  "message_id": "789…",
  "action_taken": "delete_and_warn"
}

Testing

test.ping

Fired by the Send test event button on the dashboard. Useful for confirming your receiver is wired up before any real event happens.

{
  "message": "Test event from the Phantom dashboard.",
  "sent_by_user_id": "345678901234567890",
  "sent_at": "2026-05-24T11:32:18+00:00"
}