---
title: "POST /v4/{+parent}/subscribers"
method: POST
path: "/v4/{+parent}/subscribers"
tags: ["projects"]
---

# POST /v4/{+parent}/subscribers

`POST /v4/{+parent}/subscribers`

Registers a new subscriber endpoint to receive notifications. A subscriber represents an application or service that wishes to receive data change notifications for users who have granted consent. **Endpoint Verification:** For a subscriber to be successfully created, the provided `endpoint_uri` must be a valid HTTPS endpoint and must pass an automated verification check. The backend will send two HTTP POST requests to the `endpoint_uri`: 1. **Verification with Authorization:** * **Headers:** Includes `Content-Type: application/json` and `Authorization` (with the exact value from `CreateSubscriberPayload.endpoint_authorization.secret`). * **Body:** `{"type": "verification"}` * **Expected Response:** HTTP `201 Created`. 2. **Verification without Authorization:** * **Headers:** Includes `Content-Type: application/json`. The `Authorization` header is OMITTED. * **Body:** `{"type": "verification"}` * **Expected Response:** HTTP `401 Unauthorized` or `403 Forbidden`. Both tests must pass for the subscriber creation to succeed. If verification fails, the operation will not be completed and an error will be returned. This process ensures the endpoint is reachable and correctly validates the `Authorization` header.

## Path parameters

- `parent` string, required

## Query parameters

- `subscriberId` string

## Request body

- CreateSubscriberPayload — Payload for creating a subscriber.
  - `endpointUri` string — Required. The full HTTPS URI where update notifications will be sent. The URI must be a valid URL and use HTTPS as the scheme. This endpoint will be verified during the `CreateSubscriber` call. See CreateSubscriber RPC documentation for verification details.
  - `subscriberConfigs` SubscriberConfig[] — Optional. Configuration for the subscriber.
    - `dataTypes` string[] — Required. See [Google Health API data types](https://developers.google.com/health/data-types) for the list of supported data types. Values should be in kebab-case.
    - `subscriptionCreatePolicy` 'SUBSCRIPTION_CREATE_POLICY_UNSPECIFIED' | 'AUTOMATIC' | 'MANUAL' — Required. Policy for subscription creation.
  - `endpointAuthorization` EndpointAuthorization — Authorization mechanism for a subscriber endpoint. For all requests sent by the Webhooks service, the JSON payload is cryptographically signed. The signature is delivered in the `GOOGLE-HEALTH-API-SIGNATURE` HTTP header. This is an ECDSA (NIST P256) signature of the JSON payload. Clients must verify this signature using Google Health API's public key to confirm the payload was sent by the Health API.
    - `secretSet` boolean — Output only. Whether the secret is set.
    - `secret` string — Required. Input only. Provides a client-provided secret that will be sent with each notification to the subscriber endpoint using the "Authorization" header. The value must include the authorization scheme, e.g., "Bearer " or "Basic ", as it will be used as the full Authorization header value. This secret is used by the API to test the endpoint during `CreateSubscriber` and `UpdateSubscriber` calls, and will be sent in the `Authorization` header for all subsequent webhook notifications to this endpoint.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/health.md) · [All operations](https://skmtc.dev/google/apis/health/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/health/revisions/601e805b7a55/schema)