Create a Subscription
POST /subscriptions
Environment and operation
Use this endpoint contract with the account and environment assigned to your integration. Values in angle brackets are placeholders. This reference does not execute requests. Documented server https://sandbox.signup.nmi.com/api/v1 https://secure.nmi.com/api/v5/signup Schema reference: field definitions do not include every behavioral rule. Follow the workflow guidance and account prerequisites for this operation before submitting requests.
Request route
Creates a new subscription based on the provided data. #### How signing requests work When setting up, it's common to generate, store, and share a secret between your app and the app that wants to receive webhooks. The secret should be a random string, and how to create it is entirely up to you. The package will use the secret to sign a webhook call. By default, the package will add a header called ```Signature``` that will contain a signature the receiving app can use if the payload hasn't been tampered with. **Required scope:** `subscriptions:write` POST /subscriptions Security scheme Type Credential location Scopes oauth oauth2 subscriptions:write
Request language templates
Original transport templates derived from this endpoint’s documented method, server, authentication and media type. Replace path/query/credential placeholders with authorized sandbox values. These examples print the raw status and response; they do not infer business success or retry a request. Save one valid request variant from the fields/examples below as request.json. Do not combine mutually exclusive variants. The payload is deliberately not fabricated from schema defaults. Node requires a runtime with fetch; PHP requires cURL. Generated source-based examples have not been executed against provider accounts. curl --request POST \ --url 'https://sandbox.signup.nmi.com/api/v1/subscriptions' \ --header 'Authorization: Bearer <access-token>' \ --header 'Content-Type: application/json' \ --data-binary '@request.json' import { readFile } from 'node:fs/promises'; const body = await readFile('request.json', 'utf8'); const response = await fetch("https://sandbox.signup.nmi.com/api/v1/subscriptions", { method: 'POST', headers: { "Authorization": "Bearer <access-token>", "Content-Type": "application/json" }, body }); console.log(response.status, await response.text()); from urllib.request import Request, urlopen from urllib.error import HTTPError from pathlib import Path request = Request('https://sandbox.signup.nmi.com/api/v1/subscriptions', method='POST', headers={'Authorization': 'Bearer <access-token>', 'Content-Type': 'application/json'}, data=Path('request.json').read_bytes()) try: with urlopen(request, timeout=30) as response: print(response.status, response.read().decode()) except HTTPError as error: print(error.code, error.read().decode()) require 'net/http' require 'uri' uri = URI("https://sandbox.signup.nmi.com/api/v1/subscriptions") request = Net::HTTP::Post.new(uri) request["Authorization"] = "Bearer <access-token>" request["Content-Type"] = "application/json" request.body = File.binread('request.json') response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https', read_timeout: 30) { |http| http.request(request) } puts response.code puts response.body <?php $curl = curl_init('https://sandbox.signup.nmi.com/api/v1/subscriptions'); curl_setopt_array($curl, [ CURLOPT_CUSTOMREQUEST => 'POST', CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30, CURLOPT_HTTPHEADER => ['Authorization: Bearer <access-token>', 'Content-Type: application/json'], CURLOPT_POSTFIELDS => file_get_contents('request.json') ]); $response = curl_exec($curl); if ($response === false) { throw new RuntimeException(curl_error($curl)); } echo curl_getinfo($curl, CURLINFO_HTTP_CODE), PHP_EOL, $response; curl_close($curl);
Path and query parameters
Required flags apply to the parameter itself. Additional limits and enum values appear in the contract below. Parameter Location Required Type Description Idempotency-Key header false string Provide a random key (for example, UUID) to make the request idempotent [ { "in": "header", "name": "Idempotency-Key", "description": "Provide a random key (for example, UUID) to make the request idempotent", "schema": { "type": "string", "minLength": 10, "maxLength": 100 }, "required": false } ] true
Request body
Use the declared media type: application/json. Required flags below apply within the selected object or variant. Read the workflow notes before choosing a variant. Field Type Required Description Constraints callback_url string yes The callback URL of the subscription. maxLength: 1024 secret string yes The secret key is used to generate a secure signature with the **HMAC-SHA256** hashing algorithm, which is included in the webhook event `Signature` header. minLength: 6; maxLength: 64 events array yes Subscription events { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/create-subscription" }, "examples": { "success": { "summary": "Success", "description": "Subscribe to events", "value": { "callback_url": "https://your_callback_url.com", "secret": "random_secret", "events": [ "application.updated.data.requested", "application.approved", "application.declined", "application.cancelled", "application.merchant.boarded" ] } }, "invalid-url": { "summary": "Invalid URL", "description": "Subscribe with none responsive URL", "value": { "callback_url": "https://random_url_not_working.test.com", "secret": "random_secret", "events": [ "application.approved" ] } } } } }, "description": "New subscription data", "required": true } true
Responses
Match the HTTP status to its response schema below. For financial operations, also inspect the payment outcome before updating your order or retrying. HTTP status Media type Meaning 200 application/json Subscription created successfully 400 application/json Invalid Subscription { "200": { "description": "Subscription created successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/subscription" }, "examples": { "success": { "summary": "New subscription created", "description": "New subscription created", "value": { "id": "sub_a32ab32dc3209320", "callback_url": "https://your_callback_url.com", "events": [ "application.updated.data.requested", "application.approved", "application.declined", "application.cancelled", "application.merchant.boarded" ], "status": "active", "created_at": "2025-01-01T00:00:00Z", "updated_at": "2025-01-01T00:00:00Z" } } } } } }, "400": { "description": "Invalid Subscription", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/validation-error" }, "examples": { "invalid-url": { "summary": "Invalid URL", "description": "Error when invalid URL is provided.", "value": { "code": "VALIDATION_ERROR", "message": "The current URL does not respond to our request. Please ensure that it's available to receive requests.", "errors": [ "The current URL does not respond to our request. Please ensure that it's available to receive requests." ] } }, "invalid-event": { "summary": "Invalid Event", "description": "Error when invalid event is provided.", "value": { "code": "VALIDATION_ERROR", "message": "The selected events is invalid.", "errors": [ "The selected events is invalid." ] } } } } } } } true
Response fields · 200 · application/json
Field Type Required Description Constraints id string yes The unique identifier of the subscription. minLength: 20; maxLength: 20; pattern: "^sub_[a-f0-9]{16}$" callback_url string no The callback URL of the subscription. maxLength: 1024 status string yes enum: ["active", "inactive"] events array yes Subscription events created_at string yes The date and time when the application was created. maxLength: 32; format: "date-time" updated_at string yes The date and time when the application was last updated. maxLength: 32; format: "date-time"
Response fields · 400 · application/json
Field Type Required Description Constraints code string no Error code maxLength: 1000 message string no Error message maxLength: 1000 errors array no
Referenced schema definitions
References beginning with #/components resolve to these definitions. These are field contracts, not example payment values. Use the applicable variant, required fields and constraints. { "securitySchemes": { "oauth": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "/oauth/token", "scopes": { "*": "Full access", "packages:read": "Read packages information", "applications:read": "Read access to applications", "applications:write": "Write access to applications", "subscriptions:read": "Read access to subscriptions", "subscriptions:write": "Write access to subscriptions (subscribe/updated/delete)" } } } } }, "schemas": { "application-created-at": { "type": "string", "description": "The date and time when the application was created.\n", "format": "date-time", "maxLength": 32, "example": "2025-01-01T00:00:00Z" }, "application-updated-at": { "type": "string", "description": "The date and time when the application was last updated.\n", "format": "date-time", "maxLength": 32, "example": "2025-01-01T00:00:00Z" }, "validation-error": { "type": "object", "properties": { "code": { "type": "string", "description": "Error code", "maxLength": 1000 }, "message": { "type": "string", "description": "Error message", "maxLength": 1000 }, "errors": { "type": "array", "maxItems": 10, "items": { "type": "string", "description": "The error message", "maxLength": 1000 } } } }, "subscription-id": { "type": "string", "description": "The unique identifier of the subscription.", "pattern": "^sub_[a-f0-9]{16}$", "minLength": 20, "maxLength": 20 }, "subscription-callback-url": { "type": "string", "description": "The callback URL of the subscription.", "maxLength": 1024 }, "subscription-status": { "type": "string", "enum": [ "active", "inactive" ] }, "event-types": { "type": "string", "enum": [ "application.updated.data.requested", "application.approved", "application.declined", "application.cancelled", "application.merchant.closed", "application.merchant.boarded", "merchant.chargeback.added", "merchant.deposit.new", "merchant.first-batch", "merchant.processing.start", "merchant.processing.stop", "merchant.residuals.published", "merchant.retrieval.added", "merchant.statement.new" ], "example": "application.merchant.boarded" }, "subscription-events": { "type": "array", "description": "Subscription events", "maxItems": 1000, "items": { "allOf": [ { "$ref": "#/components/schemas/event-types" } ] } }, "subscription": { "type": "object", "description": "Subscription object.\n", "required": [ "id", "status", "events", "created_at", "updated_at" ], "properties": { "id": { "$ref": "#/components/schemas/subscription-id" }, "callback_url": { "$ref": "#/components/schemas/subscription-callback-url" }, "status": { "$ref": "#/components/schemas/subscription-status" }, "events": { "$ref": "#/components/schemas/subscription-events" }, "created_at": { "$ref": "#/components/schemas/application-created-at" }, "updated_at": { "$ref": "#/components/schemas/application-updated-at" } } }, "subscription-secret": { "type": "string", "description": "The secret key is used to generate a secure signature with the **HMAC-SHA256** hashing algorithm, which is included \nin the webhook event `Signature` header.\n", "minLength": 6, "maxLength": 64 }, "create-subscription": { "type": "object", "required": [ "callback_url", "secret", "events" ], "properties": { "callback_url": { "$ref": "#/components/schemas/subscription-callback-url" }, "secret": { "$ref": "#/components/schemas/subscription-secret" }, "events": { "$ref": "#/components/schemas/subscription-events" } } } } } true
Integration checks
Validate the request against its selected schema before submission. Keep secrets outside browser code. Test permitted and denied account access, validation failures and interrupted responses in the sandbox. Account-management or messaging operations require the corresponding partner access and intended recipient context.