---
title: "Create a first-touch webhook subscription"
method: POST
path: "/kol/first-touches/subscriptions"
tags: ["KOL"]
---

# Create a first-touch webhook subscription

`POST /kol/first-touches/subscriptions`

## Request

- Base URL: `https://madeonsol.com/api/v1`
- URL: `https://madeonsol.com/api/v1/kol/first-touches/subscriptions`
- Auth: HTTP bearer

ULTRA only. Each event matching `filters` is pushed via the `kol:first_touches` WS channel and/or POSTed to `webhook_url` with HMAC-SHA256 signing (header `X-MadeOnSol-Signature`). Returns `webhook_secret` once when delivery includes webhook — store it.

## Request body

- object
  - `name` string
  - `filters` object
    - `kol` string: Wallet address (32-44 base58 chars)
    - `mint_suffix` string
    - `min_first_buy_sol` number
    - `min_scout_tier` 'S' | 'A' | 'B' | 'C'
    - `min_n_touches` integer
  - `delivery_mode` 'websocket' | 'webhook' | 'both'
  - `webhook_url` string, uri: Required if delivery_mode includes webhook. HTTPS only.
  - `min_mc_usd` number, nullable: v1.6: lower bound on first-touch MC. Touches with unknown MC drop out when set.
  - `max_mc_usd` number, nullable: v1.6: upper bound on first-touch MC.

## Response `200`

Subscription created. Response includes `webhook_secret` (one-time) if a webhook URL was supplied.

- object
  - `subscription` FirstTouchSubscription: A saved /kol/first-touches/subscriptions subscription. `created_at` is present on list/GET-one/PATCH responses; `updated_at` is present on GET-one/PATCH responses (list omits it).
    - `id` string, uuid
    - `name` string, nullable
    - `filters` object
      - `kol` string, nullable: Wallet address (32-44 base58 chars)
      - `mint_suffix` string, nullable
      - `min_first_buy_sol` number, nullable
      - `min_scout_tier` 'S' | 'A' | 'B' | 'C', nullable
      - `min_n_touches` integer, nullable
    - `delivery_mode` 'websocket' | 'webhook' | 'both'
    - `webhook_url` string, uri, nullable
    - `min_mc_usd` number, nullable
    - `max_mc_usd` number, nullable
    - `is_active` boolean
    - `created_at` string, date-time
    - `updated_at` string, date-time
  - `webhook_secret` string, nullable: One-time reveal — only present when a webhook_url was supplied. Use to verify HMAC-SHA256 signatures (X-MadeOnSol-Signature).
  - `note` string, nullable

## Other responses

- `401`: Missing or invalid API key, or an expired free-tier key. Authentication-stage error: no `X-RateLimit-*` headers, no `_rid`.
- `403`: Ultra required
- `409`: Subscription quota reached (ULTRA 10 / BUSINESS 50 per user)
- `429`: Too many requests. Every 429 carries `Retry-After`. A quota 429 (`rate_limit_exceeded`, with `X-RateLimit-*`), a heavy-query concurrency 429 (`error_kind` `concurrency`/`capacity`), or the per-IP authentication-failure block (30 failed auths/min; plain `error` + `retry_after_seconds`, no `X-RateLimit-*`).
- `500`: Unexpected server error from the route (`Internal server error`, with `_rid`). Safe to retry with backoff. A failed API-key lookup is a 503 `auth_backend_unavailable`, never a 500.
- `503`: The API-key or subscription lookup could not be answered (authentication stage). Retryable and not your fault: it is never counted as a failed authentication. Honour `Retry-After`; no `X-RateLimit-*`, no `_rid`.

---

[API](https://skmtc.dev/madeonsol/apis/madeonsol-api.md) · [All operations](https://skmtc.dev/madeonsol/apis/madeonsol-api/llms.txt) · [OpenAPI document](https://skmtc.dev/madeonsol/apis/madeonsol-api/revisions/96ce84657f55?raw)