> ## Documentation Index
> Fetch the complete documentation index at: https://docs.purplelabelmd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a webhook endpoint (signing secret shown once)

> Registers an endpoint to receive deliveries for the event types you select. The registration is scoped to your client and brand automatically — no request field chooses them. The response returns an HMAC signing secret one time only: store it now to verify delivery signatures, because it is never shown again in any read, log, event, or error. The target must be an https URL.



## OpenAPI

````yaml /openapi/public-openapi.json post /v1/webhooks/registrations
openapi: 3.1.0
info:
  title: Purple API
  version: 0.0.0
servers:
  - url: https://api.dev.purplelabelmd.com
security: []
tags:
  - description: Sign a patient in and out and manage the browser session.
    name: Sessions & authentication
  - description: Run the server-driven intake questionnaire question by question.
    name: Intake
  - description: Address autocomplete for the intake flow.
    name: Addresses
  - description: Read the public status of a patient's enrollment.
    name: Enrollment
  - description: Track a client's onboarding progress.
    name: Onboarding
  - description: Read back the platform configuration stored for your brand.
    name: Brand configuration
  - description: Enable offerings for your brand and set their display copy.
    name: Offering configuration
  - description: Start and track payments for an order.
    name: Payments
  - description: Subscribe to platform events and manage delivery endpoints.
    name: Webhooks
paths:
  /v1/webhooks/registrations:
    post:
      tags:
        - Webhooks
      summary: Register a webhook endpoint (signing secret shown once)
      description: >-
        Registers an endpoint to receive deliveries for the event types you
        select. The registration is scoped to your client and brand
        automatically — no request field chooses them. The response returns an
        HMAC signing secret one time only: store it now to verify delivery
        signatures, because it is never shown again in any read, log, event, or
        error. The target must be an https URL.
      operationId: createWebhookRegistration
      parameters:
        - $ref: '#/components/parameters/BrandIdHeader'
        - $ref: '#/components/parameters/IdempotencyKeyHeader'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookRegistrationCreate'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookRegistrationCreated'
          description: created — the ONLY response ever carrying the secret
        '401':
          $ref: '#/components/responses/EdgeUnauthorized'
        '422':
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/EdgeProblem'
          description: invalid URL or event-type selection (problem+json)
      security:
        - apiKey: []
components:
  parameters:
    BrandIdHeader:
      description: >-
        Opaque brand id (brd_...). Validated to belong to the resolved client
        (§2).
      in: header
      name: X-Brand-Id
      required: true
      schema:
        pattern: ^brd_[A-Za-z0-9][A-Za-z0-9_-]*$
        type: string
    IdempotencyKeyHeader:
      description: >-
        Accepted on mutations; carried in trusted context, enforced in a later
        WI.
      in: header
      name: Idempotency-Key
      required: false
      schema:
        type: string
  schemas:
    WebhookRegistrationCreate:
      additionalProperties: false
      properties:
        event_types:
          description: a non-empty, duplicate-free selection from the event-type catalog
          items:
            $ref: '#/components/schemas/WebhookEventType'
          minItems: 1
          type: array
        url:
          description: >-
            the delivery target: an absolute https URL, with no embedded
            credentials and no fragment.
          format: uri
          maxLength: 2048
          type: string
      required:
        - url
        - event_types
      type: object
    WebhookRegistrationCreated:
      description: the creation response — the ONLY message that ever carries the secret
      properties:
        data:
          $ref: '#/components/schemas/WebhookRegistrationView'
        secret:
          description: >-
            the generated HMAC signing secret (psig_…), shown once. Store it now
            — it is held server-side and never returned again.
          type: string
      required:
        - data
        - secret
      type: object
    EdgeProblem:
      description: RFC 7807 problem+json error body.
      properties:
        detail:
          type: string
        status:
          type: integer
        title:
          type: string
        type:
          format: uri-reference
          type: string
      required:
        - type
        - title
        - status
      type: object
    WebhookEventType:
      description: >-
        The set of event-type names a webhook endpoint can subscribe to.
        Additive within v0 — new types may be added over time; existing ones are
        stable.
      enum:
        - journey.prospect.captured.v1
        - journey.intake.submitted.v1
        - journey.eligibility.evaluated.v1
        - journey.evaluation.deferred.v1
        - journey.evaluation.resumed.v1
        - journey.identity.bound.v1
        - journey.case.opened.v1
        - journey.payment.succeeded.v1
        - journey.identity.verified.v1
        - journey.visit.completed.v1
        - journey.labs.skipped.v1
        - journey.rx.transmitted.v1
        - journey.shipment.shipped.v1
        - journey.shipment.delivered.v1
        - journey.checkin.completed.v1
        - journey.step.abandoned.v1
        - onboarding.client.started.v1
        - onboarding.step.started.v1
        - onboarding.step.assigned.v1
        - onboarding.step.completed.v1
        - onboarding.step.nudged.v1
        - onboarding.step.escalated.v1
        - onboarding.agreement.executed.v1
        - onboarding.completion.gate_ready.v1
        - onboarding.completion.e2e_result.v1
        - onboarding.client.completed.v1
      type: string
    WebhookRegistrationView:
      description: >-
        A registration as returned by reads. The signing secret is not included
        and is never readable after creation — `secret_set: true` attests that
        one exists.
      properties:
        brand_id:
          description: bound from the validated X-Brand-Id at creation; immutable
          type: string
        client_id:
          description: bound from the gateway-resolved tenancy at creation; immutable
          type: string
        created_at:
          format: date-time
          type: string
        enabled:
          type: boolean
        event_types:
          items:
            $ref: '#/components/schemas/WebhookEventType'
          type: array
        registration_id:
          pattern: ^whr_[A-Za-z0-9][A-Za-z0-9_-]*$
          type: string
        secret_set:
          const: true
          type: boolean
        url:
          format: uri
          type: string
      required:
        - registration_id
        - client_id
        - brand_id
        - url
        - event_types
        - enabled
        - secret_set
        - created_at
      type: object
  responses:
    EdgeUnauthorized:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/EdgeProblem'
      description: >-
        missing, unknown, or revoked API key - one opaque body (no
        enumeration/timing oracle, §1)
  securitySchemes:
    apiKey:
      description: 'Per-client API key (M2M). Presented as `Authorization: Bearer <key>`.'
      scheme: bearer
      type: http

````