Skip to main content
POST
Create webhook subscription

Authorizations

Authorization
string
header
required

JWT token authentication

Headers

NexSpace-Version
string

Pin the request to a dated API version (e.g. 2026-05-10). Applied by app-level middleware to every /api route (server/routes/index.ts → apiVersionMiddleware), which echoes the resolved value back in the NexSpace-Version response header. Omit to get the latest version. Discover the catalog at GET /.well-known/api-versions.

Pattern: ^\d{4}-\d{2}-\d{2}$
Idempotency-Key
string

Replay guard for write requests. Applied by app-level middleware to every /api route (server/routes/index.ts → idempotencyMiddleware), which only acts on POST/PUT/PATCH — GET, DELETE and OPTIONS ignore the header. Re-sending the same key with an identical body within 24 hours replays the original response; the same key with a different body returns 409.

Maximum string length: 255

Query Parameters

orgUnitId
integer

Target organization unit (team) id. Internal operators with cross-org access use this for webhook CRUD; facility-scoped sessions omit it and the org is resolved from context.

Body

application/json
name
string
required
url
string<uri>
required
events
enum<string>[]
required
Available options:
shift_posted,
shift_filled,
credential_expired,
timesheet_approved,
lead_qualified,
payroll_completed,
staff_onboarded,
agent_run.pending_approval,
agent_run.completed,
agent_run.failed,
*
orgUnitId
integer

Alternative to orgUnitId query — internal operators only

facilityId
integer | null
metadata
object

Arbitrary key-value metadata stored with the subscription

Response

Subscription created (signing secret in response)

id
integer
orgId
integer
name
string
url
string<uri>
events
string[]
isActive
boolean
facilityId
integer | null
createdAt
string<date-time>
updatedAt
string<date-time>
signingSecret
string