Create a hub subscription
Creates a streaming-hub subscription for the tenant and returns the once-shown signing secret. The secret is shown exactly once and is never re-fetchable; the console never stores it. A refusal keeps the hub’s status and carries the hub’s own code in upstream.code: branch on that code, not on the status. On subscription_name_taken (409), existing_id names the live subscription in the caller’s own scope that holds the name. A 2xx or a refusal the hub replays for a reused X-Idempotency key carries X-Idempotency-Replayed: true, and its existing_id may name a subscription deleted since: after acting on it, send the create under a fresh key.
Partner route: the text above describes the tenant’s own route. Here the path names no party: the partner acts for the one originador its credential’s scope holds, which must be registered under the caller’s tenant; a credential whose scope holds more than one originador is refused 403 AUT-1022. An originador the bancarizador deactivated is refused 403 ORIGINADOR_DEACTIVATED until it is reactivated. The partner sees and manages only the subscriptions it created through this register’s routes: the party’s own subscriptions and any other partner’s answer 404, as a missing one does.
Authorizations
JWT bearer token issued by the identity provider.
Headers
Bearer token. A tenant route relays it to the streaming-hub as server-to-server auth.
Idempotency key, forwarded to the hub's idempotency middleware, which refuses this mutation without one.
Body
Per-event-type schema major, overriding schema_major for the types it names.
Pin the subscription to one producing application (its ce-source); absent means any producer.
"midaz"
Per-attempt delivery timeout in milliseconds, from 1000 to 20000, webhook sinks only, validated by the hub; absent or 0 means the hub's default.
20000

