---
title: "New subscription created via access-code redemption or cardless trial."
method: POST
path: "subscription.created"
tags: ["subscription.* events"]
---

# New subscription created via access-code redemption or cardless trial.

`POST subscription.created` (webhook)

### When this fires

Exactly two paths emit this event:

- **Access-code redemption**: a subscriber redeems a code against a plan.
- **Cardless trial start**: a subscriber begins a trial that took no payment method.

Both are zero-payment acquisitions. Every paid acquisition (every payment provider, both recurring subscriptions and one-time passes) emits `subscription.activated` instead, and never emits `subscription.created`.

> This event does **not** fire for paid checkouts. A card, wallet, or crypto purchase emits `subscription.activated` instead. If you are building access control for a paying audience, subscribe to both.

The `data` keys differ by path. Absent keys are **omitted entirely**, not sent as `null`.

> `access_code` carries the complete code. It is already consumed and cannot be redeemed again, but treat it as you would any other customer identifier and avoid logging it into systems you do not control.

### Caveats

- Do not treat this as the universal "a subscription exists" signal. For paid projects it never fires. The reliable pattern is to subscribe to both `subscription.created` and `subscription.activated` and de-duplicate on `data.subscription_id`.
- The access-code path also emits `access_code.redeemed` and either `member.joined` or `member.trial_joined` for the same subscription.
- The cardless-trial path also emits `subscription.trial_started` and `member.trial_joined`.
- The `POST /v1/webhook-endpoints/{endpoint}/test` endpoint sends a synthetic `subscription.created` payload regardless of your project's payment configuration. A successful test does not prove this event will fire in production.

### Related events

- `subscription.activated`: the paid-checkout equivalent.
- `access_code.redeemed`: fires alongside on the access-code path.
- `subscription.trial_started`: fires alongside on the cardless-trial path.

## Headers

- `SB-Signature` string, required
- `SB-Event-Id` string, required
- `SB-Event-Name` string, required
- `Content-Type` string, required
- `User-Agent` string, required

## Payload

- object: The envelope every event is delivered in.
  - `id` string, required: A ULID unique to the event, prefixed `evt_`. Every retry carries the same id, so it is the key to deduplicate on.
  - `type` 'subscription.created', required: The event name, always `subscription.created` here.
  - `created_at` string, date-time, required: When the event was emitted, server time, ISO 8601.
  - `api_version` string, required: The contract version of the payload shape, `2026-05-01` today. A breaking change to a shape ships under a new version.
  - `project_id` string, uuid, nullable, required: The project the event belongs to; null for team-scoped and billing events.
  - `data` object, required: The event-specific payload. Keys that do not apply to a given emission are omitted rather than sent as null, so check for presence.
    - `subscription_id` string, uuid, required: Subscription identifier.
    - `project_id` string, uuid: Access-code path only. Duplicates the envelope `project_id`.
    - `plan_id` string, uuid, required: Plan the subscription is on.
    - `subscriber_id` string, uuid, required: The subscriber's project-scoped user id.
    - `trial_ends_at` string, date-time: Cardless-trial path only. Absent on the access-code path.
    - `access_code` string: Access-code path only. The **full redeemed code**, not masked. Absent on the trial path.

## Acknowledgement `2XX`

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

## Other responses

- `default`: Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or `POST /v1/webhook-deliveries/{delivery}/retry`. After 20 consecutive failures the endpoint is paused until it is resumed.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)