---
title: "Create Subscription"
method: POST
path: "/integrations/lpr/alerts/subscriptions"
tags: ["LPR Hotlist Alert Subscriptions"]
---

# Create Subscription

`POST /integrations/lpr/alerts/subscriptions`

Create a new LPR hotlist alert webhook subscription

## Request body

- CreateSubscriptionRequest — request body schema to create a new webhook subscription
  - `name` string — optional name to describe the webhook subscription
  - `callbackUrl` string, url, required — endpoint that webhooks should be submitted to
  - `credentials` Credentials, required — authentication details for calling the webhook endpoint
    - `scheme` 'none' | 'apiKey' | 'basic' | 'oauth2', required — authentication scheme used by webhook endpoint
    - `apiKey` object — API key credentials, required if scheme is "apiKey"
      - `key` string, required — API key (this field will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the API key
    - `basic` object — basic credentials, required if scheme is "basic"
      - `username` string, required — username
      - `password` string, required — password (this field will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the basic credentials
    - `oauth2` object — OAuth2 credentials, required if scheme is "oauth2"
      - `tokenEndpoint` string, url, required — endpoint where OAuth2 token should be retrieved
      - `tokenScheme` 'body' | 'basic' — token scheme used to authenticate the token endpoint
      - `clientId` string, required — OAuth2 client ID
      - `clientSecret` string, required — OAuth2 client secret (this field will be redactd when fetching existing subscriptions)
      - `grantType` string, required — OAuth2 client grant type
      - `scope` string — scope to request for token
      - `customFields` object — key-value pairs to be appended to token request (values will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the OAuth2 token
  - `contentType` 'application/json' | 'application/xml', required — content type that webhooks should be provided as
  - `customHotlistAudienceFilter` 'any' | 'organization' — Optionally include LPR hotlist alerts from custom hotlists with restricted audiences * `any` - Custom hotlists with organization-wide audience and restricted audience e.g. role-based or user-based audiences * `organization` - Custom hotlists with organization-wide audience only
  - `enabledFirstResponderJurisdictionAlerts` boolean — indicates whether the subscription should accept hotlist alerts from shared networks in the organization's First Responder Jurisdiction or not
  - `enabled` boolean — indicates whether the subscription should be enabled or not

## Response `201`

Subscription Created

- Subscription — request body schema to create a new webhook subscription
  - `name` string — optional name to describe the webhook subscription
  - `callbackUrl` string, url, required — endpoint that webhooks should be submitted to
  - `credentials` Credentials, required — authentication details for calling the webhook endpoint
    - `scheme` 'none' | 'apiKey' | 'basic' | 'oauth2', required — authentication scheme used by webhook endpoint
    - `apiKey` object — API key credentials, required if scheme is "apiKey"
      - `key` string, required — API key (this field will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the API key
    - `basic` object — basic credentials, required if scheme is "basic"
      - `username` string, required — username
      - `password` string, required — password (this field will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the basic credentials
    - `oauth2` object — OAuth2 credentials, required if scheme is "oauth2"
      - `tokenEndpoint` string, url, required — endpoint where OAuth2 token should be retrieved
      - `tokenScheme` 'body' | 'basic' — token scheme used to authenticate the token endpoint
      - `clientId` string, required — OAuth2 client ID
      - `clientSecret` string, required — OAuth2 client secret (this field will be redactd when fetching existing subscriptions)
      - `grantType` string, required — OAuth2 client grant type
      - `scope` string — scope to request for token
      - `customFields` object — key-value pairs to be appended to token request (values will be redacted when fetching existing subscriptions)
      - `headerName` string, required — HTTP header name that should be used to supply the OAuth2 token
  - `contentType` 'application/json' | 'application/xml', required — content type that webhooks should be provided as
  - `customHotlistAudienceFilter` 'any' | 'organization' — Optionally include LPR hotlist alerts from custom hotlists with restricted audiences * `any` - Custom hotlists with organization-wide audience and restricted audience e.g. role-based or user-based audiences * `organization` - Custom hotlists with organization-wide audience only
  - `enabledFirstResponderJurisdictionAlerts` boolean — indicates whether the subscription should accept hotlist alerts from shared networks in the organization's First Responder Jurisdiction or not
  - `enabled` boolean — indicates whether the subscription should be enabled or not
  - `id` string, uuid, required — id of the webhook subscription
  - `createdAt` string, date-time — RFC3339 UTC timestamp of when the webhook subscription was created
  - `updatedAt` string, date-time — RFC3339 UTC timestamp of when the webhook subscription was most recently updated

## Other responses

- `400` — Bad Request (missing required field or credentials failed to validate)
- `403` — Forbidden (lacking appropriate scope or client claims)
- `409` — Conflict (violates a unique constraint)
- `500` — Internal Server Error

---

[API](https://skmtc.net/flocksafety/apis/oauth-api.md) · [All operations](https://skmtc.net/flocksafety/apis/oauth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/flocksafety/oauth-api/revisions/126df7964ba5/schema)