Create vendor webhook subscription

Webhooks

POST/api/v1/scent/webhooks

Registers a new webhook endpoint for the calling vendor. The signing secret is server-generated and returned in THIS response ONLY — it is never shown again. Subject to a per-vendor active-subscription cap (see the Webhooks & HMAC verification guide). The capability required is NOT fixed — it is checked per requested event type, against that event type’s own natural owner (see the event catalogue below): you need Orders to subscribe to vendor.scent.order.assigned and Offers to subscribe to vendor.scent.offer.review-decision, independently.

Body parameters

urlstring (uri)Required

eventTypesarray of string (enum)Required

Response

subscription.idstring (uuid)

subscription.urlstring (uri)

subscription.eventTypesarray of string (enum)

subscription.isActiveboolean

subscription.lastDeliveryAtstring (date-time)

subscription.lastDeliveryStatusstring (enum)

Null until the first delivery attempt. DeadLettered means every retry was exhausted.

subscription.createdAtstring (date-time)

secretstring

Shown EXACTLY ONCE — no other read ever returns it.

Other responses

400Request validation failed.

401No bearer token (UNAUTHORIZED_MISSING_TOKEN), an invalid token (UNAUTHORIZED_INVALID_TOKEN) or an expired one (UNAUTHORIZED_TOKEN_EXPIRED — mint a new token). UPSTREAM_AUTH_FAILED is different: a dependent service refused the Gateway itself. That is a server-side fault — retry later and do NOT re-mint your token. See the Rate limits & errors guide.

403One of the requested event types requires a capability your token doesn’t carry — see details.requiredCapability and details.eventType (which event type triggered it).

404No API route matches this path (NOT_FOUND_ROUTE). A missing resource on a real route returns that service’s own NOT_FOUND_* code instead.

415The request body is not sent as application/json (UNSUPPORTED_MEDIA_TYPE).

422You already have 5 active subscriptions, or the URL failed the SSRF guardrail check.

429Too many requests. Retry after the Retry-After header (seconds).

502A dependent service returned an invalid response (BAD_GATEWAY). Retry with backoff.

503The service is temporarily unavailable (SERVICE_UNAVAILABLE). Retry with backoff.

504A dependent service did not respond in time (GATEWAY_TIMEOUT). Retry with backoff.

cURL

curl --request POST \
  --url https://api-omni-vendors.linra.net/api/v1/scent/webhooks \
  --header 'Authorization: Bearer $TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
    "url": "https://your-integration.example.com/webhooks/linra",
    "eventTypes": [
      "vendor.scent.order.assigned"
    ]
  }'

JavaScript

const res = await fetch('https://api-omni-vendors.linra.net/api/v1/scent/webhooks', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: 'https://your-integration.example.com/webhooks/linra',
    eventTypes: [
      'vendor.scent.order.assigned'
    ]
  }),
});
const { payload } = await res.json();

C#

var response = await httpClient.PostAsJsonAsync(
    "https://api-omni-vendors.linra.net/api/v1/scent/webhooks",
    new
    {
        url = "https://your-integration.example.com/webhooks/linra",
        eventTypes = new[]
        {
            "vendor.scent.order.assigned"
        }
    });

var envelope = await response.Content.ReadFromJsonAsync<ApiResponse<VendorWebhookSubscriptionCreatedResponse>>();

Response

{
  "state": "SUCCESS",
  "payload": {
    "subscription": {
      "id": "5b1e3a1c-9d2e-4f3a-8b1c-9f0a2e3d4c5b",
      "url": "https://your-integration.example.com/webhooks/linra",
      "eventTypes": [
        "vendor.scent.order.assigned"
      ],
      "isActive": true,
      "lastDeliveryAt": "2026-08-22T09:14:03Z",
      "lastDeliveryStatus": "Success",
      "createdAt": "2026-08-22T09:14:03Z"
    },
    "secret": "string"
  },
  "details": null
}