Skip to main content
POST
Create a destination for this customer

Authorizations

Authorization
string
header
required

A hpt_… customer portal token, as Authorization: Bearer. Stored hashed and looked up by its full SHA-256 hash; shown once at issue. The query string (?token=) is not accepted: a token there ends up in request logs and traces. A browser page trades the token for a portalSession cookie with POST /portal/api/session.

Body

application/json

Only name, url and dataset_filter are customer-settable. Every other column is server-controlled and cannot be influenced by the request: secret (generated, whsec_ + 48 hex, AES-GCM encrypted at rest), enabled (always 1 on create), created_by (always "portal:<customer_id>"), tenant_id, project_id, portal_id, customer_id (all taken from the token), event_filter (never set) and created_at. Unknown properties in the body are ignored, not rejected.

name
string
required

Must be a non-empty string after trimming, at most 80 characters; stored trimmed.

Minimum string length: 1
url
string<uri>
required

Must be an https URL that parses. Validated exactly as the console validates a destination URL. A Slack incoming-webhook URL (hooks.slack.com) is refused (400): Slack accepts only its own message format, and the URL is a credential (#313).

Pattern: ^[Hh][Tt][Tt][Pp][Ss]://
dataset_filter
string[]

Optional. Event types to receive, a subset of the portal's event_types; omitted or empty means all of them.

Response

Created. The signing secret is returned once and never again — the stored copy is encrypted.

id
string
required

New destination id (UUID).

signing_secret
string
required

HMAC signing secret, "whsec_" followed by 48 lowercase hex characters. Shown once.