Create a webhook subscription
Registers an outbound webhook endpoint for the organization. Every matching activity event is delivered as a signed HTTP POST to the target URL. The HMAC signing secret is generated server-side and returned ONCE in the response (in the secret field); it is never retrievable again, so store it immediately. Subsequent reads expose only a secretHint (last four characters). The URL is validated against an SSRF guard and must be https:// in production. Requires a Nevermined API key. Requires organization admin privileges. Requires the organization to be on the Premium tier or higher.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Organization ID
"org-abc123"
Body
Destination URL that receives the signed webhook POST. Must be an https:// URL in production (http:// is only accepted when the server explicitly allows it for development). The host must not resolve to a private, loopback, link-local, or cloud-metadata address (SSRF guard).
2048"https://example.com/hooks/nevermined"
Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types.
Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types.
member.invited, member.joined, member.role_changed, member.deactivated, member.reactivated, member.removed, invitation.revoked, invitation.expired, group.created, group.updated, group.deactivated, group.member_added, group.member_removed, group.budget_set, group.budget_threshold_reached, group.budget_exceeded, group.budget_reset, agent.created, plan.created, plan.updated, plan.purchased, customer.added, customer.blocked, customer.unblocked, subscription.upgraded, subscription.downgraded, subscription.canceled, subscription.lapsed, webhook.delivered, webhook.failed, apikey.created, apikey.revoked, credits.redeemed Optional human-readable label shown in the dashboard.
"Billing notifications"
Response
Webhook subscription created. The response wraps the subscription and the plaintext signing secret, which is returned only this once.
Related topics
Update a webhook subscriptionGet a webhook subscriptionDelete a webhook subscriptionList webhook subscriptionsList deliveries for a webhook subscription