Skip to main content
POST
Register a webhook endpoint (signing secret shown once)

Authorizations

Authorization
string
header
required

Per-client API key (M2M). Presented as Authorization: Bearer <key>.

Headers

X-Brand-Id
string
required

Opaque brand id (brd_...). Validated to belong to the resolved client (§2).

Pattern: ^brd_[A-Za-z0-9][A-Za-z0-9_-]*$
Idempotency-Key
string

Accepted on mutations; carried in trusted context, enforced in a later WI.

Body

application/json
event_types
enum<string>[]
required

a non-empty, duplicate-free selection from the event-type catalog

Minimum array length: 1

The set of event-type names a webhook endpoint can subscribe to. Additive within v0 — new types may be added over time; existing ones are stable.

Available options:
journey.prospect.captured.v1,
journey.intake.submitted.v1,
journey.eligibility.evaluated.v1,
journey.evaluation.deferred.v1,
journey.evaluation.resumed.v1,
journey.identity.bound.v1,
journey.case.opened.v1,
journey.payment.succeeded.v1,
journey.identity.verified.v1,
journey.visit.completed.v1,
journey.labs.skipped.v1,
journey.rx.transmitted.v1,
journey.shipment.shipped.v1,
journey.shipment.delivered.v1,
journey.checkin.completed.v1,
journey.step.abandoned.v1,
onboarding.client.started.v1,
onboarding.step.started.v1,
onboarding.step.assigned.v1,
onboarding.step.completed.v1,
onboarding.step.nudged.v1,
onboarding.step.escalated.v1,
onboarding.agreement.executed.v1,
onboarding.completion.gate_ready.v1,
onboarding.completion.e2e_result.v1,
onboarding.client.completed.v1
url
string<uri>
required

the delivery target: an absolute https URL, with no embedded credentials and no fragment.

Maximum string length: 2048

Response

created — the ONLY response ever carrying the secret

the creation response — the ONLY message that ever carries the secret

data
object
required

A registration as returned by reads. The signing secret is not included and is never readable after creation — secret_set: true attests that one exists.

secret
string
required

the generated HMAC signing secret (psig_…), shown once. Store it now — it is held server-side and never returned again.