Fac-360
Companies

Change destination, events or status; never the secret

DEVELOPER and above. Partial: an absent field is left alone, and status moves a subscription between ACTIVE and PAUSED. This never rotates the secret. Rotation has its own route because a PATCH that also rotated would leave a receiver that only wanted to change its event list without a valid signature.

PATCH
/console/v1/companies/{companyId}/webhooks/subscriptions/{subscriptionId}

DEVELOPER and above. Partial: an absent field is left alone, and status moves a subscription between ACTIVE and PAUSED.

This never rotates the secret. Rotation has its own route because a PATCH that also rotated would leave a receiver that only wanted to change its event list without a valid signature.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
subscriptionId*string
Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/webhooks/subscriptions/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{}'
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "subscriptionId": "d079718b-ff63-45dd-947b-4950c023750f"}

Create a subscription, and read its signing secret once POST POST

DEVELOPER and above. Returns the signing secret ONCE, in this response and nowhere else. Unlike the machine route this takes no Idempotency-Key: an integrator retries blindly and needs a repeated POST to return the first subscription rather than create a second, but a person pressing a button does not, and asking them for an idempotency key would be asking them to understand a problem they do not have. One is minted per request, so the repository serialisation is not weakened for this door. The destination goes through the same guard as the machine route, which is what stops a subscription pointing at an internal address and being used to probe the network from inside.

Stop notifying this destination DELETE DELETE

DEVELOPER and above. A subscription of another company answers 404, because under the tenant the database chose it does not exist.