Skip to main content
POST
Create a destination for this customer

Authorizations

Authorization
string
header
required

A hpt_… customer portal token, as Authorization: Bearer. Stored hashed; shown once at issue.

Query Parameters

token
string

Portal access token (hpt_…), as an alternative to the Authorization: Bearer header.

Body

application/json

Only name, url and dataset_filter are customer-settable. Every other column is server-controlled and cannot be influenced by the request: secret (generated, whsec_ + 48 hex, AES-GCM encrypted at rest), enabled (always 1 on create), created_by (always "portal:<customer_id>"), tenant_id, project_id, portal_id, customer_id (all taken from the token), event_filter (never set) and created_at. Unknown properties in the body are ignored, not rejected.

name
string
required

Must be a non-empty string after trimming; stored trimmed.

Minimum string length: 1
url
string<uri>
required

Must start with https:// (case-insensitive). No further URL validation is performed and the value is stored verbatim (not trimmed).

Pattern: ^[Hh][Tt][Tt][Pp][Ss]://
dataset_filter
string[]

Optional subset of the portal's exposed event types. Non-string entries are dropped before validation. Every remaining entry must appear in the portal's event_types or the request is rejected. If omitted or empty: defaults to the portal's full event_types list, or null (all datasets) when the portal exposes none.

Response

Created. The signing secret is returned once and never again — the stored copy is encrypted.

id
string
required

New destination id (UUID).

signing_secret
string
required

HMAC signing secret, "whsec_" followed by 48 lowercase hex characters. Shown once.