Skip to main content
POST
Create a customer portal

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Headers

Idempotency-Key
string

Makes a POST safe to retry for 24 hours: the same key, credential, path and body returns the stored response (Idempotent-Replayed: true) instead of running again. 422 if the key was used for a different request; 409 while the first is in flight.

Required string length: 1 - 255

Path Parameters

project_id
string
required

Body

application/json
name
string
required

Trimmed; must be non-empty.

Minimum string length: 1
slug
string

Slugified server-side (lowercase, [a-z0-9-], max 48, falling back to 'portal'). Defaults to a slug of name. Unique per workspace.

event_types
string[]

Dataset names the portal exposes. Non-string entries are dropped. This also bounds what a portal customer may filter their own destinations to.

branding
object

What the portal page applies (#198, PORT-12). Only these two keys; anything else is a 400. Omit to keep what is stored; {} clears it.

embed_origins
string[]

The sites allowed to frame the portal page (#198, PORT-13): its CSP frame-ancestors. Empty (the default) means no site may. Omit to keep what is stored.

Maximum array length: 10

An exact https origin, e.g. https://app.example.com: no path, no wildcard. A trailing slash is removed.

Response

Created and enabled.

id
string
required
slug
string
required

The slug actually stored, after slugification.

ok
enum<boolean>
required
Available options:
true