Fac-360
Companies

Stop notifying this destination

DEVELOPER and above. A subscription of another company answers 404, because under the tenant the database chose it does not exist.

DELETE
/console/v1/companies/{companyId}/webhooks/subscriptions/{subscriptionId}

DEVELOPER and above. A subscription of another company answers 404, because under the tenant the database chose it does not exist.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
subscriptionId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/webhooks/subscriptions/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Authorization: Bearer apf_v2_tu_credencial"
Empty

Change destination, events or status; never the secret PATCH PATCH

DEVELOPER and above. Partial: an absent field is left alone, and status moves a subscription between ACTIVE and PAUSED. This never rotates the secret. Rotation has its own route because a PATCH that also rotated would leave a receiver that only wanted to change its event list without a valid signature.

Mint a new signing secret and read it once POST POST

DEVELOPER and above. Mints a new signing secret, returns it ONCE and invalidates the previous one. Its own route, and not a flag on the update, so that changing an event list cannot silently break every receiver verifying signatures.