--- title: Create a webhook subscription — POST /api/v1/webhook_subscriptions description: Returns the signing_secret EXACTLY ONCE. Store it; subsequent reads never re-expose it (use rotateWebhookSecret if you lose it). canonical_url: "https://cascades.crscreditapi.com/docs/api/webhooks/create-webhook-subscription" doc_version: "1.0.0" last_updated: "2026-10-09T18:04:24Z" source: "public/api-docs/v1/swagger.yaml#createWebhookSubscription" --- # Create a webhook subscription — POST /api/v1/webhook_subscriptions `POST https://cascades.crscreditapi.com/api/v1/webhook_subscriptions` - Operation id: `createWebhookSubscription` - Scopes: `webhooks:write` - Idempotent: no - OpenAPI: https://cascades.crscreditapi.com/openapi.json · https://cascades.crscreditapi.com/openapi.yaml (operationId `createWebhookSubscription`) Returns the `signing_secret` EXACTLY ONCE. Store it; subsequent reads never re-expose it (use `rotateWebhookSecret` if you lose it). The URL is validated against the SSRF guard (no private / loopback / cloud-metadata addresses, no blocked service ports). An empty or omitted `event_filter` subscribes to every event. Requires `webhooks:write`. ## Request body `application/json` — `WebhookSubscriptionCreateRequest` | Field | Type | Required | Description | |---|---|---|---| | `url` | string (uri) | yes | HTTPS endpoint. Must resolve to a public address (no private, loopback or cloud-metadata ranges). | | `event_filter` | array of WebhookEventName | no | Events to receive. Omit or pass `[]` for all events; unknown names return `422`. | | `active` | boolean | no | | ```json { "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] } ``` ## Responses ### 201 — Created (response includes signing_secret) `application/json` | Field | Type | Required | Description | |---|---|---|---| | `data` | WebhookSubscription | no | | |   `id` | integer | no | | |   `object` | string | no | | |   `url` | string | no | | |   `event_filter` | array of WebhookEventName | no | Empty = subscribed to ALL events. | |   `active` | boolean | no | | |   `last_delivered_at` | string (date-time), nullable | no | | |   `created_at` | string (date-time) | no | | |   `updated_at` | string (date-time) | no | | |   `signing_secret` | string | no | | | `meta` | Meta | no | | |   `request_id` | string | yes | Correlation id for this request. Also sent as the `X-Request-Id` response header; quote it when contacting support. | ```json { "data": { "id": 9, "object": "webhook_subscription", "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ], "active": true, "last_delivered_at": null, "created_at": "2026-09-09T13:00:00Z", "updated_at": "2026-09-09T13:00:00Z", "signing_secret": "whsec_4f1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9" }, "meta": { "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f" } } ``` ### 401 — Missing, malformed, expired or revoked bearer token. The `WWW-Authenticate` header carries the RFC 6750 challenge. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "unauthorized", "message": "A valid bearer token is required.", "details": [], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/unauthorized" } } ``` ### 403 — Token does not hold the required scope. `details` lists the scope(s) that were checked. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "insufficient_scope", "message": "This token does not have the required scope.", "details": [ { "field": "scope", "message": "executions:write" } ], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope" } } ``` ### 422 — `validation_failed` — bad URL, non-public host, or an unknown event name `application/json` — `ErrorEnvelope` ```json { "error": { "code": "validation_failed", "message": "The request could not be processed.", "details": [ { "field": "event_filter", "message": "contains unknown event: execution.started" } ], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/validation_failed" } } ``` ### 429 — Rate limit exceeded (60 req/min per IP on `/api/v1`, 600 req/hour per token prefix, or 300 req/5 min per IP globally). The body is the standard error envelope and `Retry-After` gives the seconds until the window resets. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "rate_limited", "message": "Rate limit exceeded. Retry later.", "details": [], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/rate_limited" } } ``` ## Code samples ### cURL ```shell curl -X POST "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions" \ -H "Authorization: Bearer {{API_KEY}}" \ -H "Content-Type: application/json" \ -d '{ "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] }' ``` ### Node.js ```javascript const response = await fetch("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions", { method: "POST", headers: { "Authorization": "Bearer {{API_KEY}}", "Content-Type": "application/json" }, body: JSON.stringify({ "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] }) }); const { data, meta } = await response.json(); console.log(response.status, data, meta.request_id); ``` ### Python ```python import requests response = requests.post( "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions", headers={ "Authorization": "Bearer {{API_KEY}}", }, json={ "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] }, ) response.raise_for_status() payload = response.json() print(payload["data"], payload["meta"]["request_id"]) ``` ### Ruby ```ruby require "net/http" require "json" uri = URI("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions") request = Net::HTTP::Post.new(uri) request["Authorization"] = "Bearer {{API_KEY}}" request["Content-Type"] = "application/json" request.body = <<~JSON { "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] } JSON response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http| http.request(request) end payload = JSON.parse(response.body) puts payload["data"], payload.dig("meta", "request_id") ``` ### Go ```go package main import ( "bytes" "fmt" "io" "net/http" ) func main() { body := []byte(`{ "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed", "execution.failed", "adverse_action.completed" ] }`) req, err := http.NewRequest("POST", "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions", bytes.NewBuffer(body)) if err != nil { panic(err) } req.Header.Set("Authorization", "Bearer {{API_KEY}}") req.Header.Set("Content-Type", "application/json") resp, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer resp.Body.Close() out, _ := io.ReadAll(resp.Body) fmt.Println(resp.StatusCode, string(out)) } ``` ### Agent ```shell claude mcp add cascades \ -e CASCADES_API_KEY={{API_KEY}} \ -e CASCADES_PROD_BASE_URL=https://cascades.crscreditapi.com \ -- npx -y @crscreditapi/cascades-mcp-server # Then ask your assistant: # "Create a webhook subscription using the Cascades API." # No MCP tool covers this endpoint yet; the assistant can call POST /webhook_subscriptions with curl. ``` ## Related - [Webhooks](https://cascades.crscreditapi.com/docs/concepts/webhooks) ## Sitemap See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.