Webhooks

Subscribe to events

Register a URL to receive POSTs when the specified events fire in this workspace. The response includes a one-time signingSecret — store it immediately, you cannot recover it later. URL constraints:

  • Must be https:// in production.
  • Must not resolve to a loopback, link-local, or RFC1918 address (re-checked after DNS at every delivery to defeat rebind attacks).
  • Max 20 subscriptions per workspace.
post/webhooks/subscriptions

Request

  • Base URL: https://services.certseal.com/api/v1
  • URL: https://services.certseal.com/api/v1/webhooks/subscriptions
  • Auth: HTTP bearer

Request body

urlstring uri required

Endpoint that receives webhook POSTs. Must be https:// in production and must not resolve to a private/loopback address.

eventsWebhookEventType[] required

Response

Subscription created. signingSecret is shown ONCE.

signingSecretstring required

Raw HMAC signing secret. Returned here exactly once; the server stores its own copy for signing outbound requests but never reveals it again.

Example response

{
  "signingSecret": "wh_sec_AbCdEfGh01234567890abcdefghijKLMN"
}

Changes

No recorded changes to this operation across all 1 revision of this API.