Register a webhook endpoint

Register an HTTPS endpoint and the event types it should receive. The signing secret is generated by us and returned once in this response — store it and use it to verify the X-Vault-Signature header on deliveries (see the Webhooks section of each event below).

POST/webhook-subscriptions

Authorization

X-API-KeyAPI key · headerrequired

API key in format `sk_*`. Scoped to your partner account; server-side use only.

Header parameters

Idempotency-Keystringrequired

Unique key for safe retries. Reusing a key on the same endpoint returns the original result.

max length 255

Request body

requiredapplication/json

urlstring<uri>required

HTTPS endpoint to receive deliveries. Loopback, private, link-local, and cloud-metadata destinations—and redirects to them—are rejected.

matches ^https://

event_typesWebhookEventType[]required

min items 1

Responses

201Subscription created. `secret` is shown only once.

idstring<uuid>required

urlstring<uri>required

matches ^https://

event_typesWebhookEventType[]required

activebooleanrequired

created_atstring<date-time>required

secretstringrequired

HMAC signing secret. Returned only in this response — store it securely; it cannot be retrieved again.

400Validation failed.

codeErrorCoderequired

Stable machine-readable error vocabulary for v1.

Allowed:validation_errorstate_conflictenvironment_mismatchunsupported_destinationinvalid_api_keynot_foundrate_limited

extraobjectrequired

Structured details such as field errors or SKU availability.

messagestringrequired

Human-readable summary.

401Missing, invalid, expired, or environment-mismatched API key.

codeErrorCoderequired

Stable machine-readable error vocabulary for v1.

Allowed:validation_errorstate_conflictenvironment_mismatchunsupported_destinationinvalid_api_keynot_foundrate_limited

extraobjectrequired

Structured details such as field errors or SKU availability.

messagestringrequired

Human-readable summary.

429Rate limit exceeded for this API key.

codeErrorCoderequired

Stable machine-readable error vocabulary for v1.

Allowed:validation_errorstate_conflictenvironment_mismatchunsupported_destinationinvalid_api_keynot_foundrate_limited

extraobjectrequired

Structured details such as field errors or SKU availability.

messagestringrequired

Human-readable summary.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

API keyRemember on this deviceInclude my values in samples

Parameters

Idempotency-Keyheader*Unique key for safe retries. Reusing a key on the same endpoint returns the original result.

Bodyapplication/json

Request body

Request

curl -X POST "https://api.vault.stashtab.gg/v1/webhook-subscriptions" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Idempotency-Key: string" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "http://example.com",
  "event_types": [
    "item.intake.completed"
  ]
}'

const response = await fetch("https://api.vault.stashtab.gg/v1/webhook-subscriptions", {
  method: "POST",
  headers: {
    "X-API-Key": "YOUR_API_KEY",
    "Idempotency-Key": "string",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "url": "http://example.com",
  "event_types": [
    "item.intake.completed"
  ]
})
});

Response

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "url": "http://example.com",
  "event_types": [
    "item.intake.completed"
  ],
  "active": true,
  "created_at": "2019-08-24T14:15:22Z",
  "secret": "string"
}

{
  "code": "validation_error",
  "extra": {},
  "message": "string"
}

{
  "code": "validation_error",
  "extra": {},
  "message": "string"
}

{
  "code": "validation_error",
  "extra": {},
  "message": "string"
}