---
title: "Create a subscription"
method: POST
path: "/notifications"
tags: ["Notifications"]
---

# Create a subscription

`POST /notifications`

## Request

- Base URL: `https://commareports.com/api/v1`
- URL: `https://commareports.com/api/v1/notifications`
- Auth: HTTP bearer

Subscribe a webhook to report events. Omit `report_id` to match every report the owner owns, was invited to, or shares with their team (public link access doesn't count). `signing_secret` (encrypted at rest, never returned) enables HMAC-signed deliveries. Scope: `routines`.

## Request body

- NotificationCreateRequest
  - `name` string: Defaults to 'Untitled notification'.
  - `report_id` string, uuid, nullable: Scope to one report (must be viewable) or null for all.
  - `webhook_url` string, uri, required: http(s) only.
  - `signing_secret` string, nullable: Enables HMAC-signed deliveries. Encrypted at rest; never returned.
  - `events` string[]: Defaults to all four event types.
  - `format` 'slack' | 'discord' | 'plain'

## Response `201`

Subscription created.

- NotificationSubscription
  - `id` string, uuid, required
  - `report_id` string, uuid, nullable: null = every report the owner owns, was invited to, or shares with their team.
  - `name` string, required
  - `webhook_url` string, uri, required
  - `events` string[], required
  - `format` 'slack' | 'discord' | 'plain', required
  - `enabled` boolean, required
  - `last_delivered_at` string, date-time, nullable
  - `last_delivery_status` string, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: Malformed body or invalid field.
- `401`: Missing, invalid, revoked, or expired token.
- `403`: Token missing the required scope, or no access to the resource.
- `404`: Resource not found (also returned instead of 403 where existence must not leak).
- `429`: Rate limit exceeded. Rate limit: per-token sliding window (plan-aware — Free 60 req/min, Pro 600, Team/Enterprise 6000 by default); 429 responses carry a Retry-After header.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/commareports/apis/comma-api.md) · [All operations](https://skmtc.dev/commareports/apis/comma-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commareports/apis/comma-api/revisions/cd5263522ade?raw)