post/v3/webhooks

Subscribe a URL

Operation: v3CreateWebhook
Authentication: API key

**The one `/v3` surface that is not drop-in, and the 400s say why.** `secret` is refused — we generate and rotate it, because a caller-chosen secret is a caller-chosen strength. `frequency` is refused — we deliver on the event with signed retries, and there is no batch schedule to configure. `events` uses our fifteen lifecycle names; their catch-all `travel_restriction_all` has no equivalent, so a migrating partner edits config, not code.

Request

Body

dataobjectrequired

Responses

201The created webhook. `attributes.secret` is returned exactly once, here, and is never readable again.

metaobjectrequired

dataJsonApiResourcerequired

400A malformed parameter, or a filter/include/language this endpoint cannot honour. Refused rather than ignored: an ignored filter returns a full answer that looks filtered.

errorsobject[]required

401No key, an unknown key, a revoked key, or an inactive tenant.

errorsobject[]required

403The key is valid but does not hold `webhooks:write`.

errorsobject[]required

Example

curl

curl -X POST https://api.haavisa.com/v3/webhooks \
  -H "Authorization: Bearer $HAAVISA_API_KEY"

More in JSON:API

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.