Create webhook subscription
POST /webhook-subscriptions
Requires webhooks:write, public API access and webhook access for the organisation.
Authorization
X-API-Key required
Request Body
| Field | Type | Required | Limits | Description |
|---|---|---|---|---|
name | string | Yes | min length 1, max length 100 | Subscription name |
description | string | No | max length 500 | |
url | string (uri) | Yes | HTTPS receiver URL without embedded credentials | |
events | array of scan.created, member.created, member.updated, member.status_changed, member.deleted, membership.created, membership.updated, membership.activated, membership.renewed, membership.expiring, membership.expired, membership.cancellation_scheduled, membership.cancellation_revoked, membership.cancelled, membership.payment_succeeded, membership.payment_failed, membership.refund_created, membership.refund_succeeded, membership.refund_failed, membership_type.created, membership_type.updated, membership_type.archived, membership_type.deleted, event.created, event.updated, event.published, event.unpublished, event.visibility_changed, event.cancelled, event.deleted, event_registration.created, event_registration.confirmed, event_registration.updated, event_registration.cancelled, event_registration.checked_in, event_order.created, event_order.confirmed, event_order.cancelled, event_order.payment_succeeded, event_order.payment_failed, event_order.refund_created, event_order.refund_succeeded, event_order.refund_failed, donation.created, donation.payment_succeeded, donation.payment_failed, donation.refund_created, donation.refund_succeeded, donation.refund_failed, donation.dispute_opened, donation.dispute_closed, donation_subscription.created, donation_subscription.activated, donation_subscription.updated, donation_subscription.past_due, donation_subscription.cancellation_scheduled, donation_subscription.cancellation_revoked, donation_subscription.cancelled, donation_campaign.created, donation_campaign.updated, donation_campaign.published, donation_campaign.unpublished, donation_campaign.deleted | Yes | min items 1, max items 63 | Non-empty event selection; duplicates are removed |
headers | object | No | Custom headers replace the entire existing map when supplied; send to clear. Values cannot contain line breaks. Host, Content-Type, Content-Length, Connection, Transfer-Encoding and X-RemyPass-* names are reserved. Values and signing secrets are never returned by reads |
The organisation subscription limit is enforced (default 5). New subscriptions are active. Creation validates URL syntax without sending a request to the receiver. Use the test endpoint to verify signed delivery. Store the returned secret securely; subsequent reads and updates exclude it. Secret rotation remains available in the Integrations UI.
Request Examples
curl -X POST "https://api.remypass.com/api/v1/public/webhook-subscriptions" \
-H "Accept: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "CRM sync",
"description": "Synchronise member changes",
"url": "https://example.com/webhooks/remypass",
"events": [
"member.created",
"member.updated"
],
"headers": {
"X-Integration": "crm"
}
}'Responses
| Status | Description |
|---|---|
201 | Created; signing secret is returned once |
400 | Bad request. The top-level message explains what is invalid and, where applicable, the errors array contains structured field details. |
401 | Missing or invalid API key. |
403 | The caller is not allowed to access this resource. |
429 | Rate limit exceeded. |
500 | Server error. |
201 Response Example
{
"success": true,
"message": "Success",
"data": {
"_id": "507f1f77bcf86cd799439011",
"name": "Example",
"description": "example",
"url": "https://example.com/webhook",
"events": [
"scan.created"
],
"active": true,
"lastDeliveryAt": "2026-10-06T12:00:00.000Z",
"lastSuccessfulDeliveryAt": "2026-10-06T12:00:00.000Z",
"failureCount": 0,
"maxRetries": 3,
"retryDelaySeconds": 60,
"timeoutSeconds": 30,
"createdAt": "2026-10-06T12:00:00.000Z",
"updatedAt": "2026-10-06T12:00:00.000Z",
"secret": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
}
}
Response Fields
| Field | Type | Description | Attributes |
|---|---|---|---|
success | boolean | ||
message | string | ||
data | object & object | Show child attributes
|