Create a hub subscription
Creates a streaming-hub subscription for the tenant and returns the once-shown signing secret. The secret is shown exactly once and is never re-fetchable; the console never stores it. A refusal keeps the hub’s status and carries the hub’s own code in upstream.code: branch on that code, not on the status. On subscription_name_taken (409), existing_id names the live subscription in the caller’s own scope that holds the name. A 2xx or a refusal the hub replays for a reused X-Idempotency key carries X-Idempotency-Replayed: true, and its existing_id may name a subscription deleted since: after acting on it, send the create under a fresh key.
Partner route: the text above describes the tenant’s own route. Here the register id in the path names the fund or originador the partner acts for: it must be in the partner credential’s scope and registered under the caller’s tenant. The partner sees and manages only the subscriptions it created through this register’s routes: the party’s own subscriptions and any other partner’s answer 404, as a missing one does. An originador the bancarizador deactivated is refused 403 ORIGINADOR_DEACTIVATED until it is reactivated.
Authorizations
JWT bearer token issued by the identity provider.
Headers
Bearer token. A tenant route relays it to the streaming-hub as server-to-server auth.
Idempotency key, forwarded to the hub's idempotency middleware, which refuses this mutation without one.
Path Parameters
The originador's register id, as returned in the id field of GET /v1/consignado/originadores. It must be in the partner credential's scope.
"6f1c2a3b-4d5e-4f60-8a7b-9c0d1e2f3a4b"
Body
Per-event-type schema major, overriding schema_major for the types it names.
Pin the subscription to one producing application (its ce-source); absent means any producer.
"midaz"
Per-attempt delivery timeout in milliseconds, from 1000 to 20000, webhook sinks only, validated by the hub; absent or 0 means the hub's default.
20000

