subscription.created
New subscription created via access-code redemption or cardless trial.
When this fires
Exactly two paths emit this event:
- Access-code redemption: a subscriber redeems a code against a plan.
- Cardless trial start: a subscriber begins a trial that took no payment method.
Both are zero-payment acquisitions. Every paid acquisition (every payment provider, both recurring subscriptions and one-time passes) emits subscription.activated instead, and never emits subscription.created.
This event does not fire for paid checkouts. A card, wallet, or crypto purchase emits
subscription.activatedinstead. If you are building access control for a paying audience, subscribe to both.
The data keys differ by path. Absent keys are omitted entirely, not sent as null.
access_codecarries the complete code. It is already consumed and cannot be redeemed again, but treat it as you would any other customer identifier and avoid logging it into systems you do not control.
Caveats
- Do not treat this as the universal "a subscription exists" signal. For paid projects it never fires. The reliable pattern is to subscribe to both
subscription.createdandsubscription.activatedand de-duplicate ondata.subscription_id. - The access-code path also emits
access_code.redeemedand eithermember.joinedormember.trial_joinedfor the same subscription. - The cardless-trial path also emits
subscription.trial_startedandmember.trial_joined. - The
POST /v1/webhook-endpoints/{endpoint}/testendpoint sends a syntheticsubscription.createdpayload regardless of your project's payment configuration. A successful test does not prove this event will fire in production.
Related events
subscription.activated: the paid-checkout equivalent.access_code.redeemed: fires alongside on the access-code path.subscription.trial_started: fires alongside on the cardless-trial path.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
How is this guide?
Last updated on