---
title: "Create a new notification subscription. Note: The webhook secret is stored but never returned in API responses for security."
method: POST
path: "/notification_subscription"
tags: ["notifications"]
---

# Create a new notification subscription. Note: The webhook secret is stored but never returned in API responses for security.

`POST /notification_subscription`

## Request

- Base URL: `https://api.replicated.com/vendor/v3`
- URL: `https://api.replicated.com/vendor/v3/notification_subscription`
- Auth: API key in header `Authorization`

Required RBAC Policy: team/notifications/subscriptions/create

## Request body

- object
  - `customHeaders` CustomHeaderInput[]
    - `name` string
    - `value` string
  - `emailAddress` string
  - `eventConfigs` NotificationEventConfig[]
    - `eventType` string
    - `filters` object
  - `events` string[]
  - `failureContact` string
  - `isEnabled` boolean
  - `name` string
  - `webhookSecret` string
  - `webhookUrl` string

## Response `201`

CreateNotificationSubscriptionResponse contains the created notification subscription

- NotificationSubscription: NotificationSubscription represents a notification subscription
  - `activeMutesCount` integer
  - `createdAt` string, date-time
  - `createdBy` Actor
    - `description` string
    - `id` string
    - `link` string
    - `timestamp` string, date-time
    - `type` string
  - `customHeaders` CustomHeaderMasked[]
    - `maskedValue` string
    - `name` string
  - `deletedAt` string, date-time
  - `emailAddress` string
  - `emailVerified` boolean
  - `eventConfigs` NotificationEventConfig[]
    - `eventType` string
    - `filters` object
  - `failureContact` string
  - `id` string
  - `isEnabled` boolean
  - `name` string
  - `readonly` boolean
  - `requiresVerification` boolean
  - `teamId` string
  - `updatedAt` string, date-time
  - `userId` string
  - `webhookUrl` string

## Other responses

- `400`: Returned on bad input
- `401`: Return if the caller is not authorized
- `403`: Returned if the caller does not have the needed permission
- `429`: Return if the caller is being rate limited

## Changes

- **2026-11-03** `a36c6aead22f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/replicated/apis/vendor-api-v3-2/changes/notification_subscription/post.md)

---

[API](https://skmtc.dev/replicated/apis/vendor-api-v3-2.md) - [All operations](https://skmtc.dev/replicated/apis/vendor-api-v3-2/llms.txt) - [OpenAPI document](https://skmtc.dev/replicated/apis/vendor-api-v3-2/revisions/a36c6aead22f?raw)