Create a subscription, and read its signing secret once

DEVELOPER and above. Returns the signing secret ONCE, in this response and nowhere else. Unlike the machine route this takes no Idempotency-Key: an integrator retries blindly and needs a repeated POST to return the first subscription rather than create a second, but a person pressing a button does not, and asking them for an idempotency key would be asking them to understand a problem they do not have. One is minted per request, so the repository serialisation is not weakened for this door. The destination goes through the same guard as the machine route, which is what stops a subscription pointing at an internal address and being used to probe the network from inside.

curl -X POST "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/webhooks/subscriptions" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "url": "http://example.com",    "events": [      "document.accepted"    ]  }'

{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "subscriptionId": "d079718b-ff63-45dd-947b-4950c023750f",  "url": "http://example.com",  "events": [    "string"  ],  "status": "ACTIVE",  "description": "string",  "secretVersion": 0,  "createdAt": "2019-08-24T14:15:22Z",  "secret": "string"}