Create a webhook subscription
Create a webhook subscription. Returns the whsec_… signing secret EXACTLY ONCE (the store keeps only an HMAC). Delivery payloads are signed Enfinitos-Signature: t=<unix-seconds>,v1=<hex-hmac> where the HMAC-SHA256 covers <unix-seconds>.<raw-body>. Delivery is asynchronous and at-least-once: each attempt has a 10-second timeout, failures retry on an exponential backoff with jitter (~30s, 2m, 10m, 1h), and after 5 attempts the delivery is dead_lettered (replayable manually). Make your receiver idempotent and return 2xx quickly. The url must be absolute and https. Requires a key carrying the wildcard * scope.
Authorizations
API key sent as Authorization: Bearer <api-key>.
Body
HTTPS endpoint that receives delivery POSTs.
Event kinds to subscribe to. Use ["*"] for everything.
1Webhook event taxonomy. Note that some kinds are defined but do not currently fire on the sandbox surface (e.g. right.resumed, right.expired, challenge.withdrawn, proof_pack.sealed, and the key.* kinds); subscribe to them safely for forward-compatibility.
*, right.issued, right.suspended, right.resumed, right.revoked, right.expired, basis.registered, offer.proposed, offer.accepted, offer.rejected, offer.countered, offer.withdrawn, challenge.opened, challenge.resolved, challenge.withdrawn, delivery.observed, proof_pack.sealed, key.issued, key.revoked, key.rotated 1 - 60