Create a webhook for the authenticated tenant
Tenant-scoped webhook creation. The subscription is automatically scoped to the authenticated tenant. Tenants can only subscribe to tenant-accessible event types: budget., reservation., tenant.* (29 of 51 types).
api_key., policy., webhook., and system. events require admin access.
TENANT-ACCESSIBLE BOUNDARY (NORMATIVE): - event_types: every entry MUST be tenant-accessible (budget.,
reservation., tenant.*). A restricted event type MUST be rejected
with 400 INVALID_REQUEST.
- event_categories: every entry MUST likewise be a tenant-accessible
category (budget, reservation, tenant). A category whose event types
are admin-only (api_key, policy, webhook, system) MUST be rejected
with 400 INVALID_REQUEST. Rationale: event_categories is ADDITIVE
with event_types in delivery matching (see
WebhookSubscription.event_categories) — an unvalidated category
widens the subscription beyond the tenant-accessible set even when
every entry in event_types is allowed, so validating event_types
alone does not enforce the boundary. - The same boundary applies to updateTenantWebhook, partial updates
included: any provided event_types or event_categories array is
validated in full.
SUBSCRIPTION SELECTOR INVARIANT (NORMATIVE): every persisted subscription MUST match at least one selector — at least one of event_types / event_categories MUST be non-empty. A create or update whose resulting state would leave BOTH empty MUST be rejected with 400 INVALID_REQUEST (see WebhookSubscription.event_types). On create, event_types is additionally required and non-empty; on update it MAY be cleared to empty for a CATEGORY-ONLY subscription provided event_categories remains non-empty (see WebhookUpdateRequest — SELECTOR CLEARING). Category-only subscriptions on this plane are still bound by the TENANT-ACCESSIBLE BOUNDARY above.
PERMISSIONS: - Requires webhooks:write permission on the API key.
Authorizations
Tenant-scoped API key for runtime operations (consistent with Cycles Protocol)
Request Body
Responses
Subscription created