Criar uma assinatura
Cria uma assinatura de entrega para o tenant autenticado. O tenant é obtido apenas a partir das claims validadas do JWT — um tenant_id no corpo é ignorado.
Uma assinatura webhook nasce active e gera um segredo de assinatura (signing secret) que é retornado exatamente uma vez nesta resposta (veja signingSecret). Uma assinatura de fila (sqs, rabbitmq, eventbridge) nasce pending_verification e não gera segredo; ela permanece não entregável até que uma credencial de saída seja fornecida e sondada via PUT /v1/subscriptions/{id}/credential. Um sink_config ou credential inline no create é rejeitado — as credenciais de fila chegam apenas no PUT de credencial.
Autorizações
Um JWT bearer emitido pelo plugin-auth (lib-auth). A identidade do tenant é resolvida a partir das claims validadas do token; a superfície /v1 nunca lê um tenant do corpo, do path ou da query. Chamadores de máquina obtêm um token via o fluxo client-credentials do plugin-auth. A superfície /admin autoriza contra um escopo de operador e não carrega contexto de tenant.
Cabeçalhos
A client-chosen unique key that makes this mutation at-most-once. A mutation sent without it is rejected before any write with 400 missing_idempotency_key. Reusing the same key with an identical request replays the original response byte-for-byte (with X-Idempotency-Replayed: true); reusing it with a different request body returns 409 idempotency_conflict. To re-drive a corrected request, mint a new key.
Corpo
The create body. It carries no tenant_id (the tenant is resolved from the JWT). Inline sink_config / credential fields are rejected with 422 inline_sink_config_forbidden — queue credentials arrive only via the credential PUT.
A human label for the subscription. Required and non-blank (whitespace-only is rejected).
"orders-webhook"
The delivery destination kind. webhook posts signed HTTPS requests; pull exposes an inbox read over GET /v1/events; sqs, rabbitmq, and eventbridge fan out to the named queue or bus.
webhook, pull, sqs, rabbitmq, eventbridge The destination address, interpreted per sink kind. For webhook, an https:// URL with no embedded userinfo. For pull, omit it — the server synthesizes a pull://<id> value. For sqs, the https:// queue URL. For rabbitmq, an "<exchange>/<routingKey>" string (exchange required, routing key optional). For eventbridge, the event-bus name / detail-type addressing string. The broker host or AWS region for queue kinds lives in the encrypted credential, not here.
"https://hooks.example.com/lerian"
The event types to deliver. Validated softly against the catalog — an unknown type warns but never blocks onboarding.
Optional schema-major pin. When set, delivery follows the versioned topic for that major; when omitted, the subscription follows the base topic.
1
The plan tier for the subscription.
"standard"
Resposta
A assinatura foi criada. O signingSecret está presente apenas para um sink webhook e é exibido exatamente uma vez — salve-o ao recebê-lo, pois não pode ser recuperado depois, apenas rotacionado.
The create response. signingSecret is present only for a webhook sink and is shown exactly once; it is stored only as ciphertext and is never returned by any read path.
The non-secret projection of a subscription. It never carries the signing secret or any credential material.
The one-time webhook signing secret (write-only). Minted server-side, returned exactly once here, and never retrievable later — only rotated. Absent for non-webhook sinks.
"whsec_9f8c2b1e4a7d6055c3e2f10987ab4c21"

