> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maple.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook subscription

> Subscribes a notification URL to event types. Returns the HMAC signing secret once.



## OpenAPI

````yaml /openapi/developer-api.json post /webhook_subscriptions
openapi: 3.1.0
info:
  title: Maple Developer API
  version: 0.0.1
  description: >-
    Public API for POS and platform partners to integrate with Maple: granted
    locations and connections, the order loop (validation, notification,
    accept/deny, status updates), payment-link visibility, menu publishing, and
    HMAC-signed webhooks. Authenticate every request with a Bearer API key
    (`mpk_test_…` / `mpk_live_…`). The credential determines the environment:
    test-mode credentials only see test data, live-mode credentials only see
    live data.
servers:
  - url: https://api.maple.inc/v1
    description: Production
  - url: https://api.staging.maple.inc/v1
    description: Sandbox (development and testing)
security: []
tags:
  - name: General
    description: Service status and credential introspection.
  - name: Locations
    description: The restaurant locations your app has been granted access to.
  - name: Connections
    description: Become (or stop being) a granted location’s order receiver.
  - name: Menu
    description: Publish and read a connected location’s menu.
  - name: Orders
    description: 'The order loop: read orders, submit validation results, and decide orders.'
  - name: Webhooks
    description: Event-type catalog, subscriptions, the event ledger, and replay.
paths:
  /webhook_subscriptions:
    post:
      tags:
        - Webhooks
      summary: Create webhook subscription
      description: >-
        Subscribes a notification URL to event types. Returns the HMAC signing
        secret once.
      operationId: developer-api.createWebhookSubscription
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                notification_url:
                  type: string
                  allOf:
                    - pattern: ^\S[\s\S]*\S$|^\S$|^$
                    - minLength: 1
                event_types:
                  type: array
                  items:
                    type: string
              required:
                - notification_url
                - event_types
              additionalProperties: false
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  object:
                    type: string
                    enum:
                      - webhook_subscription.created
                  subscription:
                    type: object
                    properties:
                      object:
                        type: string
                        enum:
                          - webhook_subscription
                      id:
                        type: string
                      environment:
                        type: string
                        enum:
                          - test
                          - live
                      notification_url:
                        type: string
                      event_types:
                        type: array
                        items:
                          type: string
                      status:
                        type: string
                        enum:
                          - enabled
                          - disabled
                      created_at:
                        type: string
                      updated_at:
                        type: string
                    required:
                      - object
                      - id
                      - environment
                      - notification_url
                      - event_types
                      - status
                      - created_at
                      - updated_at
                    additionalProperties: false
                  signing_secret:
                    type: string
                    description: >-
                      One-time HMAC-SHA256 signing secret (`mwhsec_…`) used to
                      verify webhook deliveries. Store it now; it is never shown
                      again.
                required:
                  - object
                  - subscription
                  - signing_secret
                additionalProperties: false
        '400':
          description: DeveloperApiBadRequest
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeveloperApiBadRequest'
        '401':
          description: DeveloperApiUnauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeveloperApiUnauthorized'
        '403':
          description: DeveloperApiForbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeveloperApiForbidden'
      security:
        - bearer: []
components:
  schemas:
    DeveloperApiBadRequest:
      type: object
      properties:
        _tag:
          type: string
          enum:
            - DeveloperApiBadRequest
        message:
          type: string
      required:
        - _tag
        - message
      additionalProperties: false
    DeveloperApiUnauthorized:
      type: object
      properties:
        _tag:
          type: string
          enum:
            - DeveloperApiUnauthorized
        message:
          type: string
      required:
        - _tag
        - message
      additionalProperties: false
    DeveloperApiForbidden:
      type: object
      properties:
        _tag:
          type: string
          enum:
            - DeveloperApiForbidden
        code:
          type: string
          enum:
            - insufficient_scope
            - wrong_environment
        message:
          type: string
      required:
        - _tag
        - code
        - message
      additionalProperties: false
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: >-
        API key — `mpk_test_…` for the sandbox, `mpk_live_…` for production.
        Issued by Maple during partner onboarding.

````