curl --request POST \
--url https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "https://example.com/hooks/nevermined",
"eventTypes": [
"plan.purchased",
"customer.blocked"
],
"description": "Billing notifications"
}
'import requests
url = "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks"
payload = {
"url": "https://example.com/hooks/nevermined",
"eventTypes": ["plan.purchased", "customer.blocked"],
"description": "Billing notifications"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://example.com/hooks/nevermined',
eventTypes: ['plan.purchased', 'customer.blocked'],
description: 'Billing notifications'
})
};
fetch('https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => 'https://example.com/hooks/nevermined',
'eventTypes' => [
'plan.purchased',
'customer.blocked'
],
'description' => 'Billing notifications'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks"
payload := strings.NewReader("{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}"
response = http.request(request)
puts response.read_bodyCreate a webhook subscription
Registers an outbound webhook endpoint for the organization. Every matching activity event is delivered as a signed HTTP POST to the target URL. The HMAC signing secret is generated server-side and returned ONCE in the response (in the secret field); it is never retrievable again, so store it immediately. Subsequent reads expose only a secretHint (last four characters). The URL is validated against an SSRF guard and must be https:// in production. Requires a Nevermined API key. Requires organization admin privileges. Requires the organization to be on the Premium tier or higher.
curl --request POST \
--url https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "https://example.com/hooks/nevermined",
"eventTypes": [
"plan.purchased",
"customer.blocked"
],
"description": "Billing notifications"
}
'import requests
url = "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks"
payload = {
"url": "https://example.com/hooks/nevermined",
"eventTypes": ["plan.purchased", "customer.blocked"],
"description": "Billing notifications"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://example.com/hooks/nevermined',
eventTypes: ['plan.purchased', 'customer.blocked'],
description: 'Billing notifications'
})
};
fetch('https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => 'https://example.com/hooks/nevermined',
'eventTypes' => [
'plan.purchased',
'customer.blocked'
],
'description' => 'Billing notifications'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks"
payload := strings.NewReader("{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.nevermined.app/api/v1/organizations/{orgId}/webhooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"https://example.com/hooks/nevermined\",\n \"eventTypes\": [\n \"plan.purchased\",\n \"customer.blocked\"\n ],\n \"description\": \"Billing notifications\"\n}"
response = http.request(request)
puts response.read_bodyAuthorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Organization ID
"org-abc123"
Body
Destination URL that receives the signed webhook POST. Must be an https:// URL in production (http:// is only accepted when the server explicitly allows it for development). The host must not resolve to a private, loopback, link-local, or cloud-metadata address (SSRF guard).
2048"https://example.com/hooks/nevermined"
Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types.
Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types.
member.invited, member.joined, member.role_changed, member.deactivated, member.reactivated, member.removed, invitation.revoked, invitation.expired, group.created, group.updated, group.deactivated, group.member_added, group.member_removed, group.budget_set, group.budget_threshold_reached, group.budget_exceeded, group.budget_reset, agent.created, plan.created, plan.updated, plan.purchased, customer.added, customer.blocked, customer.unblocked, subscription.upgraded, subscription.downgraded, subscription.canceled, subscription.lapsed, webhook.delivered, webhook.failed, apikey.created, apikey.revoked, credits.redeemed ["plan.purchased", "customer.blocked"]
Optional human-readable label shown in the dashboard.
"Billing notifications"
Response
Webhook subscription created. The response wraps the subscription and the plaintext signing secret, which is returned only this once.
Was this page helpful?