> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.rushorder.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.rushorder.com/_mcp/server.

# Create a webhook subscription

POST https://dream.rushorder.com/api/webhooks/subscriptions
Content-Type: application/json

Webhooks are only available for certain clients. Contact your Rush Order representative to have them enabled. Creating or changing subscriptions with an API key must also be enabled for your account; otherwise this returns 403.

Creates an active subscription and returns its signing secret. The secret is shown only this once, so store it right away. To check the destination, send a test delivery with [`POST /webhooks/subscriptions/{id}/test`](https://docs.rushorder.com/api-reference/webhooks/send-test).

Reference: https://docs.rushorder.com/api-reference/webhooks/create

## Authentication

- `Authorization` header (basic auth, required) — Basic authentication of the form `Basic <base64(username:password)>`.

## Request

### Headers

- `RushOrderMomCode` (string, required) — All requests require the header to contain RushOrderMomCode, a 3 character string that represents the client internally in Rush Order. This should be given to you by Rush Order.

### Body (application/json)

This endpoint expects an object.

- `Name` (string, required) — Must be unique among your subscriptions.
- `TargetUrl` (string, required) — Where deliveries are sent. Must use `https` on port 443, have a public host name that resolves only to public IP addresses, contain no user name or password, and be at most 2048 characters.
- `EventTypes` (list of string, required) — Event codes to deliver, such as `order.shipped`. At least one is required. See [`GET /webhooks/event-types`](https://docs.rushorder.com/api-reference/webhooks/list-event-types) for the list.
- `Description` (string, optional)

## Response

### 201

Created.

- `SubscriptionId` (integer, optional)
- `Secret` (string, optional) — The signing secret, beginning with `whsec_`. This is the only time it is returned, so store it right away.
- `PreviousSecretExpiresAt` (datetime, optional, nullable) — When the previous secret stops signing deliveries. Null on create, and null when the previous secret was revoked immediately.

## Errors

### 400 Bad Request Error

The request is not valid: a missing name or event type, an unknown event type, a duplicate name, or a destination URL that breaks the rules above.

- `any`

### 403 Forbidden Error

Webhooks are not enabled for this client, or managing them with this API key is not enabled.

- `any`

## Examples

**Request**

```json
{
  "Name": "Production",
  "TargetUrl": "https://example.com/webhooks/rush-order",
  "EventTypes": [
    "order.shipped"
  ]
}
```

**Response**

```json
{
  "SubscriptionId": 12,
  "Secret": "string",
  "PreviousSecretExpiresAt": "2024-01-15T09:30:00Z"
}
```

**SDK Code**

```python
import requests

url = "https://dream.rushorder.com/api/webhooks/subscriptions"

payload = {
    "Name": "Production",
    "TargetUrl": "https://example.com/webhooks/rush-order",
    "EventTypes": ["order.shipped"]
}
headers = {
    "RushOrderMomCode": "ABC"
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers, auth=("<username>", "<password>"))

print(response.json())
```

```javascript
const url = 'https://dream.rushorder.com/api/webhooks/subscriptions';
const credentials = btoa("<username>:<password>");

const options = {
  method: 'POST',
  headers: {
    RushOrderMomCode: 'ABC',
    Authorization: `Basic ${credentials}`,
    'Content-Type': 'application/json'
  },
  body: '{"Name":"Production","TargetUrl":"https://example.com/webhooks/rush-order","EventTypes":["order.shipped"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://dream.rushorder.com/api/webhooks/subscriptions"

	payload := strings.NewReader("{\n  \"Name\": \"Production\",\n  \"TargetUrl\": \"https://example.com/webhooks/rush-order\",\n  \"EventTypes\": [\n    \"order.shipped\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("RushOrderMomCode", "ABC")
	req.SetBasicAuth("<username>", "<password>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://dream.rushorder.com/api/webhooks/subscriptions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["RushOrderMomCode"] = 'ABC'
request.basic_auth("<username>", "<password>")
request["Content-Type"] = 'application/json'
request.body = "{\n  \"Name\": \"Production\",\n  \"TargetUrl\": \"https://example.com/webhooks/rush-order\",\n  \"EventTypes\": [\n    \"order.shipped\"\n  ]\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://dream.rushorder.com/api/webhooks/subscriptions")
  .header("RushOrderMomCode", "ABC")
  .basicAuth("<username>", "<password>")
  .header("Content-Type", "application/json")
  .body("{\n  \"Name\": \"Production\",\n  \"TargetUrl\": \"https://example.com/webhooks/rush-order\",\n  \"EventTypes\": [\n    \"order.shipped\"\n  ]\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://dream.rushorder.com/api/webhooks/subscriptions', [
  'body' => '{
  "Name": "Production",
  "TargetUrl": "https://example.com/webhooks/rush-order",
  "EventTypes": [
    "order.shipped"
  ]
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'RushOrderMomCode' => 'ABC',
  ],
    'auth' => ['<username>', '<password>'],
]);

echo $response->getBody();
```

```csharp
using RestSharp;
using RestSharp.Authenticators;

var client = new RestClient("https://dream.rushorder.com/api/webhooks/subscriptions");
client.Authenticator = new HttpBasicAuthenticator("<username>", "<password>");
var request = new RestRequest(Method.POST);
request.AddHeader("RushOrderMomCode", "ABC");

request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"Name\": \"Production\",\n  \"TargetUrl\": \"https://example.com/webhooks/rush-order\",\n  \"EventTypes\": [\n    \"order.shipped\"\n  ]\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let credentials = Data("<username>:<password>".utf8).base64EncodedString()

let headers = [
  "RushOrderMomCode": "ABC",
  "Authorization": "Basic \(credentials)",
  "Content-Type": "application/json"
]
let parameters = [
  "Name": "Production",
  "TargetUrl": "https://example.com/webhooks/rush-order",
  "EventTypes": ["order.shipped"]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://dream.rushorder.com/api/webhooks/subscriptions")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```