> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commenda.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook subscription

> Create a partner-level webhook subscription for incorporation issue events. The full signing secret is returned only in this create response.

Creates a partner-level webhook subscription.

The response includes the full `secret` exactly once. Store it securely and use it to verify webhook signatures. Later reads return only `secretPreview`.

Webhook URLs must use HTTPS and must be reachable on public addresses.

## Example

```bash theme={null}
curl --request POST \
  --url 'https://api.prod.commenda.io/api/v1/partner/webhook-subscriptions' \
  --header 'content-type: application/json' \
  --header 'x-api-key: <partner_api_key>' \
  --data '{
    "url": "https://partner.example.com/commenda/webhooks",
    "eventTypes": [
      "INCORPORATION_ISSUE_CREATED",
      "INCORPORATION_ISSUE_RESOLVED"
    ]
  }'
```


## OpenAPI

````yaml POST /partner/webhook-subscriptions
openapi: 3.0.1
info:
  title: Commenda Public APIs
  description: >-
    APIs for Commenda entity management, partner incorporation, indirect tax,
    compliance, and corporate operations.
  license:
    name: NONE
    url: NONE
  version: 1.0.0
servers:
  - url: https://api.prod.commenda.io/api/v1
    description: Commenda platform APIs, including Partner Incorporation and Commenda OS.
  - url: https://transaction-tax.api.in.commenda.io/api/v1
    description: Global Indirect Tax API.
security:
  - bearerAuth: []
paths:
  /partner/webhook-subscriptions:
    post:
      summary: Create webhook subscription
      description: >-
        Create a partner-level webhook subscription for incorporation issue
        events. The full signing secret is returned only in this create
        response.
      operationId: createPartnerWebhookSubscription
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PartnerCreateWebhookSubscriptionRequest'
      responses:
        '201':
          description: Webhook subscription created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartnerCreateWebhookSubscriptionResponse'
        '400':
          description: Malformed request or unsafe webhook URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AffiliatePublicError'
        '401':
          description: Missing or invalid partner API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AffiliatePublicError'
      security:
        - xApiKeyAuth: []
      servers:
        - url: https://api.prod.commenda.io/api/v1
components:
  schemas:
    PartnerCreateWebhookSubscriptionRequest:
      type: object
      required:
        - url
        - eventTypes
      properties:
        url:
          type: string
          format: uri
          description: HTTPS webhook URL reachable on a public address.
          example: https://partner.example.com/commenda/webhooks
        eventTypes:
          type: array
          minItems: 1
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PartnerWebhookEventType'
      example:
        url: https://partner.example.com/commenda/webhooks
        eventTypes:
          - INCORPORATION_ISSUE_CREATED
          - INCORPORATION_ISSUE_RESOLVED
    PartnerCreateWebhookSubscriptionResponse:
      type: object
      required:
        - webhookSubscription
      properties:
        webhookSubscription:
          $ref: '#/components/schemas/PartnerCreatedWebhookSubscription'
    AffiliatePublicError:
      type: object
      required:
        - statusCode
        - message
        - error
      properties:
        statusCode:
          type: integer
          example: 403
        message:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          example: Company does not belong to this affiliate firm
        error:
          type: string
          example: Forbidden
    PartnerWebhookEventType:
      type: string
      description: >-
        Partner webhook event type. Commenda may add additional event types in
        future API updates.
      enum:
        - INCORPORATION_ISSUE_CREATED
        - INCORPORATION_ISSUE_RESOLVED
    PartnerCreatedWebhookSubscription:
      allOf:
        - $ref: '#/components/schemas/PartnerWebhookSubscription'
        - type: object
          required:
            - secret
          properties:
            secret:
              type: string
              description: >-
                Full signing secret. Returned only when the subscription is
                created.
              example: whsec_abc123
    PartnerWebhookSubscription:
      type: object
      required:
        - id
        - url
        - eventTypes
        - status
        - secretPreview
        - createdAt
      properties:
        id:
          type: string
          example: whsub_123
        url:
          type: string
          format: uri
          example: https://partner.example.com/commenda/webhooks
        eventTypes:
          type: array
          items:
            $ref: '#/components/schemas/PartnerWebhookEventType'
        status:
          $ref: '#/components/schemas/PartnerWebhookSubscriptionStatus'
        secretPreview:
          type: string
          description: Redacted signing secret preview returned by read/list endpoints.
          example: whsec_...c123
        createdAt:
          type: string
          format: date-time
          example: '2026-04-25T21:00:00.000Z'
    PartnerWebhookSubscriptionStatus:
      type: string
      enum:
        - ACTIVE
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
    xApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key

````