Skip to main content
This path needs four hub calls. It subscribes to the hub’s own hub.destination.verified lifecycle fact, so you do not need a separate product producer for the first end-to-end check. Every /v1 call sends the Authorization: Bearer TOKEN header and Content-Type: application/json. The hub never takes the tenant from a request body, path, or query.

​
Before you start

You need:
  • A running hub and a token with the Streaming Hub subscriptions get and post permissions. The catalog read also needs catalog get.
  • A public https:// endpoint you control. The hub rejects private, loopback, and cloud-metadata addresses.

​
The four calls

​
1. Find the matching key and origin

GET /v1/catalog Find the entry whose eventKey is hub.destination.verified. Its source is streaming-hub. Put eventKey in event_types exactly as the catalog serves it. Do not build it from resourceType and eventType. Put source in origin.

​
2. Create the subscription

POST /v1/subscriptions Send X-Idempotency with a unique value.
event_types takes catalog eventKey values, not full CloudEvents types. origin pins the subscription to one ce-source. Omit it only when you intentionally want the same key from any producer. Both fields are immutable after creation. schema_major is optional. plan_tier defaults to standard. The 201 response carries the new subscription with its id, and the plaintext signingSecret. Save the secret now. No read route returns it. A retry with the same X-Idempotency key returns the same response.

​
3. Activate the destination and emit the test fact

POST /v1/subscriptions/{id}/ping A new webhook starts in pending_verification. The ping sends a signed probe through the production delivery path. Your endpoint must answer with 2xx.
outcome: "ok" moves the subscription to active. After that state change commits, the hub attempts to emit hub.destination.verified with ce-source: streaming-hub. If that best-effort emission succeeds, the subscription you just created matches the fact and receives it. Repeating the ping for an already-active subscription probes the endpoint again but does not re-emit the lifecycle event.

​
4. Confirm the delivery

Your endpoint receives a signed POST with X-Lerian-Event-Id, X-Lerian-Event-Type, and X-Lerian-Delivery-Id. Verify the HMAC before trusting the body and deduplicate on X-Lerian-Event-Id. Then call GET /v1/subscriptions/{id}/health. A fresh last_success_at and a delivered count in delivery_outcomes confirm the path works end to end. A pull subscription needs no endpoint or ping. Create it with sink_kind: "pull", then read GET /v1/events?subscription_id=<id>. See Managing subscriptions and Consuming events for lifecycle, signatures, retries, and cursors.