> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Create a CDP destination subscription > Create a destination subscription that fans matching CDP events out to a webhook or a Nango-routed SaaS destination. Pick the `destination` kind, the HTTPS `target_url` (or `nango://` for Nango-routed connectors) and the `event_types` to forward; optionally attach a `filter_predicate`, a Bernoulli `sampling_rate`, a redaction/mapping `policy` or a `consent_channel` gate. The response returns a one-time plaintext `secret` used to sign deliveries — copy it into your destination-side verifier now, because only its last four characters are retrievable afterwards. Owner / admin / developer only, and the creation is audit-logged. ## OpenAPI ````yaml /openapi.yaml post /api/v1/cdp/subscriptions openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/cdp/subscriptions: post: tags: - CDP summary: Create a CDP destination subscription description: >- Create a destination subscription that fans matching CDP events out to a webhook or a Nango-routed SaaS destination. Pick the `destination` kind, the HTTPS `target_url` (or `nango://` for Nango-routed connectors) and the `event_types` to forward; optionally attach a `filter_predicate`, a Bernoulli `sampling_rate`, a redaction/mapping `policy` or a `consent_channel` gate. The response returns a one-time plaintext `secret` used to sign deliveries — copy it into your destination-side verifier now, because only its last four characters are retrievable afterwards. Owner / admin / developer only, and the creation is audit-logged. requestBody: required: true content: application/json: schema: type: object required: - name - target_url - event_types properties: name: type: string maxLength: 120 destination: type: string default: webhook description: >- Destination kind (e.g. `webhook`, `salesforce`, `braze`, `hubspot`); defaults to `webhook`. target_url: type: string description: >- HTTPS endpoint, or `nango://` for Nango-routed destinations. event_types: type: array items: type: string minItems: 1 maxItems: 64 config: type: object additionalProperties: true filter_predicate: oneOf: - type: object additionalProperties: true - type: 'null' description: >- Optional AND-of-comparisons predicate; events that do not match are dropped before dispatch. sampling_rate: type: - 'null' - number minimum: 0 maximum: 1 description: >- Optional Bernoulli sampling rate in [0, 1]; null delivers every event. consent_channel: type: string description: >- Optional per-subscription consent channel to gate delivery on the contact's consent. example: name: Salesforce contact sync destination: webhook target_url: https://hooks.example.com/orbit/cdp event_types: - contact.created - contact.updated sampling_rate: 1 responses: '200': description: The created subscription plus a one-time plaintext signing `secret`. content: application/json: schema: type: object properties: data: allOf: - $ref: '#/components/schemas/CdpSubscription' - type: object properties: secret: type: string description: >- The plaintext signing secret — returned once, on this response only. meta: $ref: '#/components/schemas/ResponseMeta' components: schemas: CdpSubscription: type: object description: >- A CDP destination subscription — its delivery target, event filter/sampling settings and current circuit-breaker health. The signing secret is never returned in full; `secret_suffix` exposes only the last four characters for visual diffing across rotations. properties: id: type: string name: type: string destination: type: string description: Destination kind (e.g. `webhook`, `salesforce`, `braze`). target_url: type: - 'null' - string secret_suffix: type: - 'null' - string description: Last four characters of the current signing secret. event_types: type: array items: type: string status: type: string enum: - active - paused consecutive_failures: type: integer description: >- Consecutive delivery failures; the breaker trips when this crosses the threshold. last_success_at: type: - 'null' - string format: date-time last_failure_at: type: - 'null' - string format: date-time last_error: type: - 'null' - string circuit_opened_at: type: - 'null' - string format: date-time description: >- When the circuit breaker last tripped; null when the breaker is closed. config: type: object additionalProperties: true filter_predicate: oneOf: - type: object additionalProperties: true - type: 'null' description: >- Optional per-subscription event-property predicate; null delivers every matching event. sampling_rate: type: - 'null' - number description: >- Optional Bernoulli sampling rate in [0, 1]; null delivers every event. created_at: type: string format: date-time updated_at: type: string format: date-time ResponseMeta: type: object required: - request_id - timestamp additionalProperties: false properties: request_id: type: string description: Unique request identifier (also returned as X-Request-Id header) timestamp: type: string format: date-time docs_url: type: string format: uri nullable: true securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````