--- title: "Create a callout template" method: POST path: "/notifications/callout-templates" tags: ["Notifications"] --- # Create a callout template `POST /notifications/callout-templates` Creates a callout template. This operation supports creating the callout template for all event types: - To create a callout template for a standard event, you must specify the `eventCategory` field. For more information about standard event category codes, see Standard event category code for events and notifications. - To create a callout template for a Zuora custom event, custom event, or custom scheduled event, you must specify the `eventTypeName` field. For more information, see Zuora custom events, [Custom event triggers](https://developer.zuora.com/api-references/api/tag/Custom-Event-Triggers/), and [Custom scheduled events](https://developer.zuora.com/api-references/api/tag/Custom-Scheduled-Events/). You must specify either `eventCategory` or `eventTypeName`, but not both at the same time. ## Headers - `Idempotency-Key` string - `Accept-Encoding` string - `Content-Encoding` string - `Zuora-Track-Id` string - `Zuora-Entity-Ids` string - `Zuora-Org-Ids` string ## Request body - union - POSTPublicCalloutTemplateRequestCommon — Common information for callout templates. - `active` boolean — The status of the callout. The default is `true`. - `calloutBaseurl` string, url, required — The callout URL. It must start with `https://`. Zuora uses port 443 to send callout notifications by default. If you want to use other ports, submit a request at Zuora Global Support. You can add merge fields in the callout URL. For example, `https://mywebsite.com/zuora/{{DataSource.Account.Id}}`. For more information, see Merge field syntax for email and callout templates. - `calloutHeaders` object — Container for custom callout headers. Each custom callout header consists of a header name and a header value. - `calloutParams` object — Container for callout parameters sent in the request body. Each callout parameter consists of a parameter name and a parameter value. - `calloutRetry` boolean — Specified whether to retry the callout when the callout fails. The default value is `true`. - `certificate` string — The SSL certificate for the domain of the callout receiver server specified in `calloutBaseurl`. The value must be in PEM format, which typically starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. Specifying the SSL certificate can eliminate SSL certificate errors (HTTP status code 495) for callout notifications. - `confirmSuccessFromResponseContent` boolean — Indicates how Zuora determines whether callout notifications to your system succeed or fail: * If `false`, Zuora determines the result based solely on the HTTP response status code. This is the default value. * If `true`, and the HTTP response status code is 200, Zuora evaluates the callout response and considers the notification successful only if the `Content-Type` header is set to `application/json`, and the response body contains a `success` field set to `true`. - `customRequestBody` string — Customized request body. This field is available only for callouts whose Content-Type in the request body is `application/json`. The value must be in JSON format and double quotes in the value must be escaped. You can add merge fields to the request body. For example, `{\"AccountNumber\": \"{{DataSource.Account.AccountNumber}}\",\"AccountId\": \"{{DataSource.Account.Id}}\"}`. For more information, see Merge field syntax for email and callout templates. You must set `useCustomRequestBody` to `true` if you want to customize the callout request body with this field. Alternatively, you can use the `calloutParams` field. - `description` string — Description for the callout template. - `eventCategory` number — The event category code for a standard event that the callout template relates to. This field is required when creating callout templates for standard events. For the list of supported standard event category codes, see Standard event category code for events and notifications. - `eventTypeName` string — The name of a custom event that the callout template relates to. This field is required when creating callout templates for Zuora custom events, custom events, or custom scheduled events. If this field is provided, you can specify the event namespace in the `eventTypeNamespace` field. - `eventTypeNamespace` 'user.notification' | 'com.zuora.notification' — The namespace of the `eventTypeName` field. It indicates who created the event and which namespace the event is assigned to. Supported values are as follows: - `com.zuora.notification`: events that are created by Zuora. This value applies to Zuora custom events. - `user.notification`: events that are created by tenant users. This value applies to custom events and custom scheduled events. This is the default value. For example, if you want to create a callout template that relates to the `OrderActionProcessed` event, which is a Zuora custom event, you must specify `com.zuora.notification` for this field. - `hmacAlgorithm` 'MD5' | 'SHA-1' | 'SHA-224' | 'SHA-256' | 'SHA-384' | 'SHA-512' — The hash function Zuora uses to generate the signed data for HMAC authentication. - `hmacData` string — The message to be authenticated for HMAC authentication. You can use merge fields in this value: - `{{Request.Headers.}}`: Refers to the value of a particular request header. For example, `{{Request.Headers.Date}}` refers to the value of the request header called `Date`. - `{{Request.Body}}`: Refers to the request body. - Other merge fields: See Merge field syntax for email and callout templates. - `hmacKey` string — The header key that Zuora uses to send the header value for HMAC authentication. The header value is specified in the `hmacValue` field and typically contains the signed data. - `hmacOutputFormat` 'BASE64' | 'HEX' — The format of the signed data for HMAC authentication. - `hmacSecret` string — The shared secret key that Zuora uses to generate the signed data for HMAC authentication. - `hmacValue` string — The header value for HMAC authentication. The header key is specified in the `hmacKey` field. You can use merge fields in this value: - `{{Request.HMAC.Signed}}`: Refers to the signed data. - Other merge fields: See Merge field syntax for email and callout templates. The following is a header value example: `The algorithm is SHA-256 and the signed data is {{Request.HMAC.Signed}}`. - `httpMethod` 'POST' | 'GET' | 'PUT' | 'PATCH' | 'DELETE', required — The HTTP method of the callout. - `name` string, required — The name of the callout template. It must be unique across all callout templates. - `useCustomRequestBody` boolean — Indicates whether to enable the customized request body configured in the `customRequestBody` field. - POSTPublicCalloutTemplateRequestBasicAuthentication — The Basic Authentication information for callout templates. - `active` boolean — The status of the callout. The default is `true`. - `calloutBaseurl` string, url, required — The callout URL. It must start with `https://`. Zuora uses port 443 to send callout notifications by default. If you want to use other ports, submit a request at Zuora Global Support. You can add merge fields in the callout URL. For example, `https://mywebsite.com/zuora/{{DataSource.Account.Id}}`. For more information, see Merge field syntax for email and callout templates. - `calloutHeaders` object — Container for custom callout headers. Each custom callout header consists of a header name and a header value. - `calloutParams` object — Container for callout parameters sent in the request body. Each callout parameter consists of a parameter name and a parameter value. - `calloutRetry` boolean — Specified whether to retry the callout when the callout fails. The default value is `true`. - `certificate` string — The SSL certificate for the domain of the callout receiver server specified in `calloutBaseurl`. The value must be in PEM format, which typically starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. Specifying the SSL certificate can eliminate SSL certificate errors (HTTP status code 495) for callout notifications. - `confirmSuccessFromResponseContent` boolean — Indicates how Zuora determines whether callout notifications to your system succeed or fail: * If `false`, Zuora determines the result based solely on the HTTP response status code. This is the default value. * If `true`, and the HTTP response status code is 200, Zuora evaluates the callout response and considers the notification successful only if the `Content-Type` header is set to `application/json`, and the response body contains a `success` field set to `true`. - `customRequestBody` string — Customized request body. This field is available only for callouts whose Content-Type in the request body is `application/json`. The value must be in JSON format and double quotes in the value must be escaped. You can add merge fields to the request body. For example, `{\"AccountNumber\": \"{{DataSource.Account.AccountNumber}}\",\"AccountId\": \"{{DataSource.Account.Id}}\"}`. For more information, see Merge field syntax for email and callout templates. You must set `useCustomRequestBody` to `true` if you want to customize the callout request body with this field. Alternatively, you can use the `calloutParams` field. - `description` string — Description for the callout template. - `eventCategory` number — The event category code for a standard event that the callout template relates to. This field is required when creating callout templates for standard events. For the list of supported standard event category codes, see Standard event category code for events and notifications. - `eventTypeName` string — The name of a custom event that the callout template relates to. This field is required when creating callout templates for Zuora custom events, custom events, or custom scheduled events. If this field is provided, you can specify the event namespace in the `eventTypeNamespace` field. - `eventTypeNamespace` 'user.notification' | 'com.zuora.notification' — The namespace of the `eventTypeName` field. It indicates who created the event and which namespace the event is assigned to. Supported values are as follows: - `com.zuora.notification`: events that are created by Zuora. This value applies to Zuora custom events. - `user.notification`: events that are created by tenant users. This value applies to custom events and custom scheduled events. This is the default value. For example, if you want to create a callout template that relates to the `OrderActionProcessed` event, which is a Zuora custom event, you must specify `com.zuora.notification` for this field. - `hmacAlgorithm` 'MD5' | 'SHA-1' | 'SHA-224' | 'SHA-256' | 'SHA-384' | 'SHA-512' — The hash function Zuora uses to generate the signed data for HMAC authentication. - `hmacData` string — The message to be authenticated for HMAC authentication. You can use merge fields in this value: - `{{Request.Headers.}}`: Refers to the value of a particular request header. For example, `{{Request.Headers.Date}}` refers to the value of the request header called `Date`. - `{{Request.Body}}`: Refers to the request body. - Other merge fields: See Merge field syntax for email and callout templates. - `hmacKey` string — The header key that Zuora uses to send the header value for HMAC authentication. The header value is specified in the `hmacValue` field and typically contains the signed data. - `hmacOutputFormat` 'BASE64' | 'HEX' — The format of the signed data for HMAC authentication. - `hmacSecret` string — The shared secret key that Zuora uses to generate the signed data for HMAC authentication. - `hmacValue` string — The header value for HMAC authentication. The header key is specified in the `hmacKey` field. You can use merge fields in this value: - `{{Request.HMAC.Signed}}`: Refers to the signed data. - Other merge fields: See Merge field syntax for email and callout templates. The following is a header value example: `The algorithm is SHA-256 and the signed data is {{Request.HMAC.Signed}}`. - `httpMethod` 'POST' | 'GET' | 'PUT' | 'PATCH' | 'DELETE', required — The HTTP method of the callout. - `name` string, required — The name of the callout template. It must be unique across all callout templates. - `useCustomRequestBody` boolean — Indicates whether to enable the customized request body configured in the `customRequestBody` field. - `requiredAuth` boolean, required — Indicates whether Basic authentication is enabled for the callout. When creating callout templates with Basic authentication enabled, you must set this field to `true` and specify the username and password in `calloutAuth`. - `calloutAuth` CalloutAuth, nullable — If `requiredAuth` is `true`, this object is required. - `domain` string — The domain of the callout auth. - `password` string — The field is required when `requiredAuth` is `true`. - `preemptive` boolean — Set this field to `true` if you want to enable the preemptive authentication. - `username` string — The field is required when `requiredAuth` is `true`. - POSTPublicCalloutTemplateRequestOauth2Authentication — The OAuth 2.0 Authentication information for callout templates. - `active` boolean — The status of the callout. The default is `true`. - `calloutBaseurl` string, url, required — The callout URL. It must start with `https://`. Zuora uses port 443 to send callout notifications by default. If you want to use other ports, submit a request at Zuora Global Support. You can add merge fields in the callout URL. For example, `https://mywebsite.com/zuora/{{DataSource.Account.Id}}`. For more information, see Merge field syntax for email and callout templates. - `calloutHeaders` object — Container for custom callout headers. Each custom callout header consists of a header name and a header value. - `calloutParams` object — Container for callout parameters sent in the request body. Each callout parameter consists of a parameter name and a parameter value. - `calloutRetry` boolean — Specified whether to retry the callout when the callout fails. The default value is `true`. - `certificate` string — The SSL certificate for the domain of the callout receiver server specified in `calloutBaseurl`. The value must be in PEM format, which typically starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. Specifying the SSL certificate can eliminate SSL certificate errors (HTTP status code 495) for callout notifications. - `confirmSuccessFromResponseContent` boolean — Indicates how Zuora determines whether callout notifications to your system succeed or fail: * If `false`, Zuora determines the result based solely on the HTTP response status code. This is the default value. * If `true`, and the HTTP response status code is 200, Zuora evaluates the callout response and considers the notification successful only if the `Content-Type` header is set to `application/json`, and the response body contains a `success` field set to `true`. - `customRequestBody` string — Customized request body. This field is available only for callouts whose Content-Type in the request body is `application/json`. The value must be in JSON format and double quotes in the value must be escaped. You can add merge fields to the request body. For example, `{\"AccountNumber\": \"{{DataSource.Account.AccountNumber}}\",\"AccountId\": \"{{DataSource.Account.Id}}\"}`. For more information, see Merge field syntax for email and callout templates. You must set `useCustomRequestBody` to `true` if you want to customize the callout request body with this field. Alternatively, you can use the `calloutParams` field. - `description` string — Description for the callout template. - `eventCategory` number — The event category code for a standard event that the callout template relates to. This field is required when creating callout templates for standard events. For the list of supported standard event category codes, see Standard event category code for events and notifications. - `eventTypeName` string — The name of a custom event that the callout template relates to. This field is required when creating callout templates for Zuora custom events, custom events, or custom scheduled events. If this field is provided, you can specify the event namespace in the `eventTypeNamespace` field. - `eventTypeNamespace` 'user.notification' | 'com.zuora.notification' — The namespace of the `eventTypeName` field. It indicates who created the event and which namespace the event is assigned to. Supported values are as follows: - `com.zuora.notification`: events that are created by Zuora. This value applies to Zuora custom events. - `user.notification`: events that are created by tenant users. This value applies to custom events and custom scheduled events. This is the default value. For example, if you want to create a callout template that relates to the `OrderActionProcessed` event, which is a Zuora custom event, you must specify `com.zuora.notification` for this field. - `hmacAlgorithm` 'MD5' | 'SHA-1' | 'SHA-224' | 'SHA-256' | 'SHA-384' | 'SHA-512' — The hash function Zuora uses to generate the signed data for HMAC authentication. - `hmacData` string — The message to be authenticated for HMAC authentication. You can use merge fields in this value: - `{{Request.Headers.}}`: Refers to the value of a particular request header. For example, `{{Request.Headers.Date}}` refers to the value of the request header called `Date`. - `{{Request.Body}}`: Refers to the request body. - Other merge fields: See Merge field syntax for email and callout templates. - `hmacKey` string — The header key that Zuora uses to send the header value for HMAC authentication. The header value is specified in the `hmacValue` field and typically contains the signed data. - `hmacOutputFormat` 'BASE64' | 'HEX' — The format of the signed data for HMAC authentication. - `hmacSecret` string — The shared secret key that Zuora uses to generate the signed data for HMAC authentication. - `hmacValue` string — The header value for HMAC authentication. The header key is specified in the `hmacKey` field. You can use merge fields in this value: - `{{Request.HMAC.Signed}}`: Refers to the signed data. - Other merge fields: See Merge field syntax for email and callout templates. The following is a header value example: `The algorithm is SHA-256 and the signed data is {{Request.HMAC.Signed}}`. - `httpMethod` 'POST' | 'GET' | 'PUT' | 'PATCH' | 'DELETE', required — The HTTP method of the callout. - `name` string, required — The name of the callout template. It must be unique across all callout templates. - `useCustomRequestBody` boolean — Indicates whether to enable the customized request body configured in the `customRequestBody` field. - `requiredOauth2` boolean, required — Indicates whether OAuth 2.0 authentication is enabled for the callout. When creating callout templates with OAuth 2.0 authentication enabled, you must set this field to `true` and specify the OAuth 2.0 provider ID in `oauth2ProviderId`. - `oauth2ProviderId` unknown ## Response `200` OK - GETPublicCalloutTemplateResponse - `active` boolean — The status of the callout template. - `calloutAuth` CalloutAuth, nullable — If `requiredAuth` is `true`, this object is required. - `domain` string — The domain of the callout auth. - `password` string — The field is required when `requiredAuth` is `true`. - `preemptive` boolean — Set this field to `true` if you want to enable the preemptive authentication. - `username` string — The field is required when `requiredAuth` is `true`. - `calloutBaseurl` string, url — The callout URL. - `calloutHeaders` object, nullable — Container for custom callout headers. Each custom callout header consists of a header name and a header value. - `calloutParams` object, nullable — Container for callout parameters sent in the request body. Each callout parameter consists of a parameter name and a parameter value. - `calloutRetry` boolean — Indicates whether to retry the callout when the callout fails. - `certificate` string, nullable — The SSL certificate for the domain of the callout receiver server specified in `calloutBaseurl`. - `confirmSuccessFromResponseContent` boolean — Indicates how Zuora determines whether callout notifications to your system succeed or fail: * If `false`, Zuora determines the result based solely on the HTTP response status code. This is the default value. * If `true`, and the HTTP response status code is 200, Zuora evaluates the callout response and considers the notification successful only if the `Content-Type` header is set to `application/json`, and the response body contains a `success` field set to `true`. - `contentType` string — The callout body format. - `createdBy` string, uuid — The ID of the user who created the callout template. - `createdOn` string, date-time — The time when the callout template was created. Specified in the UTC timezone in the ISO860 format (YYYY-MM-DDThh:mm:ss.sTZD). E.g. 1997-07-16T19:20:30.45+00:00 - `customRequestBody` string, nullable — Customized request body. - `description` string — Description for the callout template. - `eventCategory` number — The event category code for the standard event that the callout template relates to. This field is available only if the related event of this callout template is a standard event. For the list of supported standard event category codes, see Standard event category code for events and notifications. - `eventTypeName` string — The name of the custom event that the callout template relates to. This field is available only if the related event of this callout template is a Zuora custom event, custom event, or custom scheduled event. - `eventTypeNamespace` 'user.notification' | 'com.zuora.notification' — The namespace of the `eventTypeName` field. It indicates who created the event and which namespace the event is assigned to. Supported values are as follows: - `com.zuora.notification`: events that are created by Zuora. This value applies to Zuora custom events. - `user.notification`: events that are created by tenant users. This value applies to custom events and custom scheduled events. This is the default value. This field is available only if the related event of this callout template is a Zuora custom event, custom event, or custom scheduled event. - `hmacAlgorithm` 'MD5' | 'SHA-1' | 'SHA-224' | 'SHA-256' | 'SHA-384' | 'SHA-512' | 'null', nullable — The hash function Zuora uses to generate the signed data for HMAC authentication. - `hmacData` string, nullable — The message to be authenticated for HMAC authentication. - `hmacKey` string, nullable — The header key that Zuora uses to send the header value for HMAC authentication. The header value is specified in the `hmacValue` field and typically contains the signed data. - `hmacOutputFormat` 'BASE64' | 'HEX' | 'null', nullable — The format of the signed data for HMAC authentication. - `hmacSecret` string, nullable — The shared secret key that Zuora uses to generate the signed data for HMAC authentication. - `hmacValue` string, nullable — The header value for HMAC authentication. The header key is specified in the `hmacKey` field. - `httpMethod` 'POST' | 'GET' | 'PUT' | 'PATCH' | 'DELETE' — The HTTP method of the callout. - `id` string, uuid — The ID of the callout template. - `name` string — The name of the callout template. - `oauth2ProviderId` string, nullable — The ID of the OAuth 2.0 provider in your tenant that provides access tokens for the callout. - `requiredAuth` boolean — Indicates whether Basic authentication is enabled for the callout. - `requiredOauth2` boolean — Indicates whether OAuth 2.0 authentication is enabled for the callout. - `updatedBy` string, uuid — The ID of the user who updated the callout template. - `updatedOn` string, date-time — The time when the callout template was updated. Specified in the UTC timezone in the ISO860 format (YYYY-MM-DDThh:mm:ss.sTZD). E.g. 1997-07-16T19:20:30.45+00:00 - `useCustomRequestBody` boolean — Indicates whether to enable the customized request body configured in the `customRequestBody` field. ## Other responses - `400` — Bad Request - `404` — Not Found - `405` — Method Not Allowed - `415` — Unsupported Media Type - `500` — Internal Server Error --- [API](https://skmtc.dev/zuora/apis/api-reference.md) · [All operations](https://skmtc.dev/zuora/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/zuora/api-reference/revisions/d11e237f3e54/schema)