---
title: "Create security settings"
method: POST
path: "/subscriptions/1/security"
tags: ["platform", "subscriptions-api", "security"]
---

# Create security settings

`POST /subscriptions/1/security`

## Request

- Base URL: `https://api.infobip.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.infobip.com/subscriptions/1/security`
- Auth: one of:
  - OAuth 2
    - Client credentials
    - Token URL: `https://api.infobip.com/auth/1/oauth2/token`
  - API key in header `Authorization`
  - API key in header `Authorization`
  - HTTP basic

This method will create new security settings.

## Request body

- 6e71a232d29cf86cbe8cd24bd719c2050de4613347854f985c920dd3d0d3e33fSecurityRequest: Security settings object holding the authentication settings necessary to access your webhook. Should only be provided if you are creating a new profile and settings; otherwise it will be ignored.
  - `authId` string, required: Unique security setting ID. Used as part of a URL path and must not include any characters that require URL encoding. You cannot change the ID once an item is created.
  - `type` 'BASIC' | 'HMAC' | 'OAUTH': Credentials type.
  - `credentials` union: Webhook security credentials.
    - object: Basic credentials.
      - `username` string, required: Username.
      - `password` string, required: Password.
    - object: HMAC credentials.
      - `secretKey` string, required: Secret key.
      - `algorithm` 'HMAC_MD5' | 'HMAC_SHA_1' | 'HMAC_SHA_224' | 'HMAC_SHA_256' | 'HMAC_SHA_384' | 'HMAC_SHA_512', required: HMAC algorithm.
    - object: OAuth credentials.
      - `tokenUrl` string, required: Token URL.
      - `clientId` string: Client ID.
      - `clientSecret` string: Client secret.
      - `grantType` string, required: Grant type.
      - `scope` string: Scope.
      - `username` string: Username.
      - `password` string: Password.
      - `resource` string: Resource.
      - `refreshToken` string: Refresh token.
      - `headers` object: Set of key:value pairs that will be sent in a HTTP request as headers.

## Response `201`

Created.

- 6e71a232d29cf86cbe8cd24bd719c2050de4613347854f985c920dd3d0d3e33fIdOnlySecurityResponse: Security configuration.
  - `authId` string: Unique authorization ID.

## Other responses

- `400`: Bad request.
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found.
- `429`: Too many requests.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/infobip/apis/infobip-openapi-specification.md) - [All operations](https://skmtc.dev/infobip/apis/infobip-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/infobip/apis/infobip-openapi-specification/revisions/9dcbbaf902de?raw)