Create a webhook subscription
POST/webhook_subscriptions
Subscribes target_url to the given event_types. The signing secret is returned
once, in data.attributes.secret — store it now; no later read returns it, and
the only way to get a new one is rotate_secret. Deliveries are HMAC-signed
(X-Kudos-Signature plus the Standard Webhooks headers) and retried.
The body takes the data.attributes envelope; a flat body is rejected with 400.
Requires an admin-tier caller (settings.manage_webhooks). Over the API that means a
PAT carrying write:webhook_subscriptions, minted by an admin.
Limits: 10 subscriptions per workspace, and https:// is required outside development.
Request
Responses
- 201
- 422
Created — signing secret returned once, in data.attributes.secret.
Validation failed — an http:// target outside development, embedded credentials
in the URL, an unknown event type, or the 10-subscription cap.