subscription.* events

New subscription created via access-code redemption or cardless trial.

When this fires

Exactly two paths emit this event:

  • Access-code redemption: a subscriber redeems a code against a plan.
  • Cardless trial start: a subscriber begins a trial that took no payment method.

Both are zero-payment acquisitions. Every paid acquisition (every payment provider, both recurring subscriptions and one-time passes) emits subscription.activated instead, and never emits subscription.created.

This event does not fire for paid checkouts. A card, wallet, or crypto purchase emits subscription.activated instead. If you are building access control for a paying audience, subscribe to both.

The data keys differ by path. Absent keys are omitted entirely, not sent as null.

access_code carries the complete code. It is already consumed and cannot be redeemed again, but treat it as you would any other customer identifier and avoid logging it into systems you do not control.

Caveats

  • Do not treat this as the universal "a subscription exists" signal. For paid projects it never fires. The reliable pattern is to subscribe to both subscription.created and subscription.activated and de-duplicate on data.subscription_id.
  • The access-code path also emits access_code.redeemed and either member.joined or member.trial_joined for the same subscription.
  • The cardless-trial path also emits subscription.trial_started and member.trial_joined.
  • The POST /v1/webhook-endpoints/{endpoint}/test endpoint sends a synthetic subscription.created payload regardless of your project's payment configuration. A successful test does not prove this event will fire in production.

Related events

  • subscription.activated: the paid-checkout equivalent.
  • access_code.redeemed: fires alongside on the access-code path.
  • subscription.trial_started: fires alongside on the cardless-trial path.
postWebhooksubscription.created

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'subscription.created' required

The event name, always subscription.created here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.