Skip to main content
POST
Create an event subscription

Authorizations

Authorization
string
header
required

An Enrik API key, sent as Authorization: Bearer <key>. A key reaches public operations only, and only those whose scopes it holds. A few parameters need a scope beyond their operation’s, which the parameter names. The scopes:

  • setup:read: Read the workspace setup and its company profile.
  • setup:run: Change the setup: confirm the company profile, authorize sponsored drafting and background company research, choose what to set up and complete setup.
  • workspace:read: Read the workspace’s own profile: its health summary and setup state.
  • crm:read: Read companies with their signals, contacts and the saved views over them.
  • crm:write: Create, update and restore companies and contacts, and create, update and delete saved views.
  • crm:delete: Delete companies and contacts.
  • twin:read: Read the Company Twin: structured company knowledge and its signals.
  • discovery:read: Read ICP profiles, ICP assessments, discovery briefs, discovery jobs, candidates and the signal library.
  • discovery:write: Create and change ICP profiles, discovery briefs and signal-definition drafts, and review discovery candidates.
  • discovery:run: Create, start and cancel discovery jobs, and edit a draft one. Uses provider budget.
  • enrichment:read: Read the enrichment configuration and its results, including a record’s enrichment, formula and custom-API cells.
  • enrichment:run: Launch and cancel enrichment. Spends enrichment credits.
  • automation:read: Read workflows and agents with their run history, including a record’s agent cells.
  • automation:run: Run existing workflows and agents.
  • exports:read: Read export jobs and the fields an export can carry.
  • exports:run: Create, preview, start, cancel and archive CSV exports of companies, contacts and candidates, and download the file. Also needs crm:read. Delivering an export to a webhook destination stays in the app.
  • integrations:read: Read connections, field mappings, CRM sync jobs and webhook destinations.
  • webhooks:read: Read webhook subscriptions, the event types they can name and their delivery log.
  • webhooks:write: Subscribe a receiver URL to webhook events; edit, test, pause, resume and archive a subscription and rotate its signing secret; redeliver an event. Only workspace owners and admins can grant it.
  • reporting:read: Read analytics and dashboards.
  • assistant:read: Read the Assistant: its threads, messages and pending approvals.
  • assistant:run: Converse with the Assistant. Uses the workspace’s AI quota.
  • assistant:write: Approve or reject the changes the Assistant proposes.

Headers

Idempotency-Key
string
required

A key you choose for this request, such as a UUID. Retrying with the same key returns the first result instead of doing the work twice.

Required string length: 1 - 200

Body

application/json

A new subscription: a receiver url (with an optional description) or an existing destinationId, exactly one, and the event types to send.

eventTypes
enum<string>[]
required

The event types to send, each once. The creator must be allowed to read what each one names.

Required array length: 1 - 10 elements
Available options:
companyDiscoveryJob.terminal,
company.created,
company.updated,
company.deleted,
company.restored,
contact.created,
contact.updated,
contact.deleted,
contact.restored,
companySignal.created
destinationId
string<uuid>

An existing webhook destination to subscribe, created in the app. Send it or url, not both.

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$
url
string<uri>

The https:// URL to send events to. Enrik creates its destination with a new signing secret, answered once. Send it or destinationId, not both.

description
string

A name for the receiver, at most 120 characters; only with url. Defaults to its host.

Required string length: 1 - 120
eventVersion
number
default:1

The payload version to receive; 1, the only one so far.

Response

A subscription and, after a create with a url or a rotation, its signing secret, delivered once.

A subscription and, after a create with a url or a rotation, its signing secret, delivered once.

id
string
required

The subscription id.

destinationId
string
required

The destination that receives the events and holds the signing secret.

url
string
required

The receiver URL, read from the subscription’s destination.

description
string
required

The destination’s name: the description given at create, or else the receiver’s host.

eventTypes
enum<string>[]
required

The event types the receiver gets; webhookEventTypes.list lists them all.

Available options:
companyDiscoveryJob.terminal,
company.created,
company.updated,
company.deleted,
company.restored,
contact.created,
contact.updated,
contact.deleted,
contact.restored,
companySignal.created
eventVersion
number
required

The payload version the receiver gets.

status
enum<string>
required

active delivers; disabled is paused (see disabledReason); archived is final.

Available options:
active,
disabled,
archived
disabledReason
enum<string> | null
required

Why it is paused: manual, or consecutive_failures after 10 failed deliveries in a row; null unless disabled.

Available options:
manual,
consecutive_failures
consecutiveFailures
number
required

Failed deliveries since the last success; enabling resets it.

lastSuccessAt
string<date-time> | null
required

When a delivery last succeeded, if ever.

Pattern: ^((\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|(02)-(0[1-9]|1\d|2[0-8])))T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?Z$
lastFailureAt
string<date-time> | null
required

When a delivery last failed, if ever.

Pattern: ^((\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|(02)-(0[1-9]|1\d|2[0-8])))T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?Z$
createdBy
string | null
required

The user who created it; null when an API key or the system did.

createdAt
string<date-time>
required

When it was created.

Pattern: ^((\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|(02)-(0[1-9]|1\d|2[0-8])))T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?Z$
updatedAt
string<date-time>
required

When it last changed.

Pattern: ^((\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\d|3[01])|(0[469]|11)-(0[1-9]|[12]\d|30)|(02)-(0[1-9]|1\d|2[0-8])))T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?Z$
signingSecret
string | null
required

The signing secret, shown once: verify X-Enrik-Signature with it. A create with a url and a rotation answer it; null when the create named an existing destination.