curl --request POST \
  --url https://hpay-api.host-sl.com/api/v1/webhooks/subscriptions \
  --header 'api-key: YOUR_API_KEY' \
  --header 'secret-key: YOUR_SECRET_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "target_url": "https://example.com/webhooks/hostpay",
    "events": [
        "deposit.completed",
        "payout.failed"
    ]
  }'

from hostpay import HostPay

client = HostPay(api_key="YOUR_API_KEY", secret_key="YOUR_SECRET_KEY")

sub = client.webhooks.subscriptions.create(
    target_url="https://example.com/webhooks/hostpay",
    events=["deposit.completed", "payout.failed"],
)
store_secret(sub["secret"])  # shown once!

import { HostPay } from "@hostpay/sdk";

const client = new HostPay({ apiKey: "YOUR_API_KEY", secretKey: "YOUR_SECRET_KEY" });

const sub = await client.webhooks.subscriptions.create({
  targetUrl: "https://example.com/webhooks/hostpay",
  events: ["deposit.completed", "payout.failed"],
});
storeSecret(sub.secret); // shown once!

{
  "secret": "whsec_9f8e7d6c...",
  "subscription": {
    "id": "7c1d2e3f-...",
    "application_id": "2e35e07e-...",
    "target_url": "https://example.com/webhooks/hostpay",
    "events": ["deposit.completed", "payout.failed"],
    "active": true,
    "ip_allowlist": null,
    "payload_version": "2025-01",
    "secret_preview": "...k3Qz",
    "created_at": "2026-07-04T10:30:00Z",
    "updated_at": "2026-07-04T10:30:00Z"
  }
}

{
  "detail": "The provided target_url is not allowed (internal or private address)."
}