Create a webhook subscription
Registers a webhook subscription tied to the App’s auth client. The
platform POSTs a signed, thin event notification to url whenever an event
whose type is in eventTypes is attributed to an org within the auth client’s
org scope. Events with empty org attribution (for example application.*)
are delivered only to internal auth clients; an org-scoped external
subscription can list those types but will not receive them.
The response includes signingSecret — the HMAC-SHA256 secret used to verify
deliveries. It is returned exactly once at creation time and cannot be
retrieved again; rotate it via the rotate-secret endpoint if lost.
The caller must hold the app:manage_webhooks grant on urn:app:<sourcedApplicationId>.
Authorizations
OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.
Path Parameters
UUID of the App the subscription is tied to
Body
Response
Subscription created (signing secret returned once)
A webhook subscription plus its plaintext signing secret. Returned only by create and rotate-secret; the secret cannot be retrieved again.
Unique identifier of the subscription.
Consumer endpoint the signed notification is POSTed to.
Event types this subscription receives.
active = delivering; paused = suspended by the owner; disabled = auto-disabled by the platform after repeated terminal delivery failures.
active, paused, disabled When the subscription was created.
HMAC-SHA256 signing secret (prefixed whsec_). Verify each delivery by computing
HMAC-SHA256(secret, timestampHeader + "." + rawBody) and comparing to the signature
header. Shown exactly once.