generated: '2026-07-18'
method: searched
source: openapi/credentially-webhook-openapi-original.json, https://credentially.readme.io/reference/subscriptions
type: Webhooks
spec_type: none
note: Credentially documents a webhook subscription API but publishes no AsyncAPI document. This captures the webhook (event) surface. No AsyncAPI fabricated.
transport: http-callback
subscription_api:
  base: https://app.credentially.io/webhook-gateway
  operations:
  - GET /subscriptions (getSubscriptions)
  - POST /subscriptions (createSubscription)
  - DELETE /subscriptions/{id} (deleteSubscription)
  - GET /meta/events (getAvailableEventTypes)
delivery:
  method: POST to subscriber callback_url
  auth: Basic auth header (Base64 of <webhookName>:<password>) set per subscription
  ack_window_seconds: 15
  retries: after 30s, 60s, 120s ... doubling backoff, up to 14 attempts
  ordering: not guaranteed
  idempotency: duplicate deliveries possible; receivers must be idempotent
  semantics: state-change notifications only; intended to be used alongside the REST API rather than carrying data directly
event_types:
  discovery: GET /meta/events returns the authoritative list (requires auth)
  documented_examples:
  - PROFILE_COMPLIANCE_STATUS_CHANGED
  - PROFILE_DBS_STATUS_CHANGED