Create subscription
Alerts
Create subscription
Creates a webhook subscription for alert notifications.
**Webhook URL requirements (SSRF protection):**
- Must be HTTPS in production.
- The host must resolve to a publicly routable address. Private or reserved addresses are rejected at creation and checked again at delivery. Restricted service ports are blocked. If a host later resolves to a non-public address, delivery stops and the reason appears on the delivery record.
If a legitimate endpoint is rejected, contact MeshQu support.
**IMPORTANT**: The response includes a `secret` field that is shown **only once**.
Save this secret securely - it cannot be retrieved again.
Webhooks are delivered with:
- X-MeshQu-Event: alert.created
- X-MeshQu-Alert-Id: uuid
- X-MeshQu-Tenant-Id: uuid
- X-MeshQu-Timestamp: Unix milliseconds
- X-MeshQu-Signature: sha256=<hmac>
Subscriptions filter alerts by:
- decision_types: Array of decision types to subscribe to
- severity_min: Minimum severity level (alerts with equal or higher severity are delivered)
**HMAC Signature Verification:**
All webhooks are signed. To verify:
1. Extract X-MeshQu-Timestamp and X-MeshQu-Signature headers
2. Compute: HMAC-SHA256(secret, timestamp + "." + body)
3. Compare: "sha256=" + hex(result) === X-MeshQu-Signature
4. Reject if timestamp is older than 5 minutes (replay protection)
POST
Create subscription
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on authenticated routes. A missing or non-UUID value returns 400 MISSING_TENANT_ID or INVALID_TENANT_ID before API-key authentication.
Body
application/json