> ## Documentation Index
> Fetch the complete documentation index at: https://docs.partners.api.cobee.io/llms.txt
> Use this file to discover all available pages before exploring further.

# [DRAFT] Register webhook subscription

<Note>
  **Coming soon**: The Webhooks API is currently under design review. This documentation describes the target interface and may change before release.
</Note>

## Overview

Registers an HTTPS endpoint to receive webhook events. You choose which [event types](/en/api-reference/webhooks/events) the subscription will receive.

> **Important**: the response includes the `signingSecret` used to sign every webhook payload sent to this subscription. It is only returned **on creation and on rotation** — store it securely. See [Verifying Signatures](/en/api-reference/webhooks/overview#verifying-signatures).

> **Important**: the endpoint URL must use HTTPS.


## OpenAPI

````yaml POST /webhooks/subscriptions
openapi: 3.0.1
info:
  title: Partners API
  description: >-
    Partners API definition where you can check the documentation for the
    different available operations to integrate with the platform.
  license:
    name: MIT
  version: 1.0.0
servers:
  - url: https://pre-partners-api.cobee.io/api/v3
  - url: https://partners-api.cobee.io/api/v3
security:
  - bearerAuth: []
paths:
  /webhooks/subscriptions:
    post:
      summary: Register a webhook subscription
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - url
                - eventTypes
              properties:
                url:
                  type: string
                  format: uri
                  description: >-
                    The HTTPS endpoint that will receive the webhook calls. Must
                    use HTTPS.
                  example: https://partner.example.com/cobee/webhooks
                eventTypes:
                  type: array
                  description: The event types this subscription will receive.
                  minItems: 1
                  items:
                    type: string
                    enum:
                      - employee.consumption.registered
                      - company.payroll-cycle.closed
                      - employee.committed-expense.requested
                      - employee.committed-expense.finished
                      - employee.committed-expense.cancelled
                      - employee.committed-expense.payment.cancelled
                  example:
                    - employee.consumption.registered
                    - company.payroll-cycle.closed
      responses:
        '201':
          description: >-
            Webhook subscription successfully created. The signing secret is
            only returned on creation and rotation — store it securely.
          content:
            application/json:
              schema:
                type: object
                required:
                  - id
                  - url
                  - eventTypes
                  - status
                  - signingSecret
                  - createdAt
                properties:
                  id:
                    type: string
                    format: uuid
                    description: The unique identifier of the subscription.
                    example: c3d4e5f6-a1b2-4c3d-8e5f-6a7b8c9d0e1f
                  url:
                    type: string
                    format: uri
                    description: The HTTPS endpoint that will receive the webhook calls.
                    example: https://partner.example.com/cobee/webhooks
                  eventTypes:
                    type: array
                    description: The event types this subscription will receive.
                    items:
                      type: string
                      enum:
                        - employee.consumption.registered
                        - company.payroll-cycle.closed
                        - employee.committed-expense.requested
                        - employee.committed-expense.finished
                        - employee.committed-expense.cancelled
                        - employee.committed-expense.payment.executed
                        - employee.committed-expense.payment.cancelled
                  status:
                    type: string
                    description: The status of the subscription.
                    enum:
                      - enabled
                      - disabled
                    example: enabled
                  signingSecret:
                    type: string
                    description: >-
                      The secret used to sign webhook payloads (HMAC-SHA256).
                      Only returned on creation and rotation.
                    example: whsec_5257a869e7ecebeda32affa62cdca3fa
                  createdAt:
                    type: integer
                    description: When the subscription was created, in timestamp format.
                    format: timestamp
                    example: 1753939051
        '400':
          description: >-
            Bad Request - The url is not a valid HTTPS endpoint or the event
            types are invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                message: Invalid request
        '500':
          description: Internal Server Error - Something went wrong on our end
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                message: Internal server error
components:
  schemas:
    Error:
      required:
        - error
        - message
      type: object
      properties:
        error:
          type: integer
          format: int32
        message:
          type: string
      example:
        message: 'Bad request: Invalid field value'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````