---
title: "Create a subscription"
url: "https://portal.konghotels.cloud/apis/kong-hotels-partner-api-1/versions/23cc133a-2f87-4d55-9490-0b8b2bb7dd78/operations/createWebhook"
---

> Full API specification: https://portal.konghotels.cloud/apis/kong-hotels-partner-api-1/versions/23cc133a-2f87-4d55-9490-0b8b2bb7dd78.md

# Create a subscription

`POST` `/webhooks`

Operation ID: `createWebhook`

**Write.** The signing `secret` is returned **only** in this response (and after rotation). Store it securely.

## Header parameters

- `Idempotency-Key` (string, optional) - Optional. Makes the request safe to retry for 24 hours.

## Request body (required)

Content types: `application/json`

## Responses

- `201` - Subscription created.
- `403` - The API is in read-only mode.
- `422` - Invalid input or a booking rule violation.

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Kong Hotels Partner API
  version: 1.0.0
servers:
  - url: https://api.konghotels.cloud
    description: Kong Gateway
paths:
  /webhooks:
    post:
      tags:
        - Webhooks
      operationId: createWebhook
      summary: Create a subscription
      description: "**Write.** The signing `secret` is returned **only** in this
        response (and after rotation). Store it securely."
      x-write: true
      parameters:
        - $ref: "#/components/parameters/IdempotencyKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/WebhookCreate"
            example:
              url: https://partner.example.com/webhooks/kong-hotels
              events:
                - reservation.created
                - reservation.modified
                - reservation.cancelled
                - availability.changed
              property_codes:
                - KTNYC
                - KBBRK
              description: Production listener
      responses:
        "201":
          description: Subscription created.
          headers:
            Location:
              $ref: "#/components/headers/Location"
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: "#/components/schemas/WebhookSubscriptionWithSecret"
        "403":
          $ref: "#/components/responses/WritesDisabled"
        "422":
          $ref: "#/components/responses/ValidationFailed"
security:
  - KongKeyAuth: []
  - KongConsumer: []
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      description: Optional. Makes the request safe to retry for 24 hours.
      schema:
        type: string
        maxLength: 255
        examples:
          - 8e03978e-40d5-43e8-bc93-6894a57f9324
  schemas:
    WebhookCreate:
      type: object
      required:
        - url
        - events
      properties:
        url:
          type: string
          format: uri
          description: Must be HTTPS in production.
        events:
          type: array
          minItems: 1
          items:
            $ref: "#/components/schemas/EventType"
        property_codes:
          type:
            - array
            - "null"
          items:
            type: string
          description: Only events for these properties; null for all.
        description:
          type:
            - string
            - "null"
        is_active:
          type: boolean
          default: true
    WebhookSubscriptionWithSecret:
      allOf:
        - $ref: "#/components/schemas/WebhookSubscription"
        - type: object
          properties:
            secret:
              type: string
              examples:
                - whsec_cfAM2gQQSALuMAOntv7LN7SXeZ9UNc0vqrLSWDOQ
    EventType:
      type: string
      enum:
        - reservation.created
        - reservation.modified
        - reservation.cancelled
        - reservation.add_ons_changed
        - availability.changed
        - rates.changed
        - property.updated
        - promotion.published
        - review.published
        - group_request.created
        - group_request.updated
        - webhook.ping
    WebhookSubscription:
      type: object
      properties:
        id:
          type: string
          examples:
            - whk_01jbx5b2c3d4e5f6g7h8j9k0m1
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            $ref: "#/components/schemas/EventType"
        property_codes:
          type:
            - array
            - "null"
          items:
            type: string
        description:
          type:
            - string
            - "null"
        is_active:
          type: boolean
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    Problem:
      type: object
      description: RFC 9457 problem details. Extra members (e.g. `available_units`,
        `restrictions`, `reasons`) may be present.
      required:
        - type
        - title
        - status
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
        request_id:
          type: string
      additionalProperties: true
    ValidationProblem:
      allOf:
        - $ref: "#/components/schemas/Problem"
        - type: object
          properties:
            errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: string
            restrictions:
              type: array
              items:
                type: string
  headers:
    Location:
      description: URL of the created resource.
      schema:
        type: string
        format: uri
  responses:
    WritesDisabled:
      description: The API is in read-only mode.
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/Problem"
          example:
            type: https://developers.konghotels.example/problems/writes-disabled
            title: Write operations are disabled
            status: 403
            detail: The Kong Hotels partner API is currently read-only. POST requests will
              be enabled in a later phase.
            instance: /quotes
            request_id: 0b7e2c9a-5d41-4e8b-a1f3-6c9d8e7f6a5b
    ValidationFailed:
      description: Invalid input or a booking rule violation.
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/ValidationProblem"
          examples:
            validation:
              value:
                type: https://developers.konghotels.example/problems/validation-failed
                title: Validation failed
                status: 422
                detail: One or more fields are invalid.
                instance: /quotes
                request_id: 7e6d5c4b-3a2f-4e1d-8c0b-9a8f7e6d5c4b
                errors:
                  check_out:
                    - The check out field must be a date after check in.
            bookingRule:
              value:
                type: https://developers.konghotels.example/problems/booking-rule-violation
                title: Booking rule violation
                status: 422
                detail: Rate plan ADV cannot be sold for these dates.
                instance: /quotes
                request_id: 8f7e6d5c-4b3a-4f2e-9d1c-0b9a8f7e6d5c
                restrictions:
                  - min_advance_purchase
  securitySchemes:
    KongKeyAuth:
      type: apiKey
      in: header
      name: apikey
      description: Your API key, validated by Kong Gateway. The header name depends on
        the gateway's key-auth configuration.
    KongConsumer:
      type: apiKey
      in: header
      name: X-Consumer-ID
      description: "**Local development only.** Simulates the consumer identity Kong
        Gateway injects after authentication."
```