Mint a callback credential

Mints an opaque bearer token bound to the caller’s tenant for authenticating inbound external-system exception callbacks, and returns the raw token ONCE. Only the token’s SHA-256 hash is stored server-side. This route does not deduplicate retries. Resending it, even with the same X-Idempotency key, mints another credential.

POST /v1/exceptions/callbacks/credentials

Mint a callback credential

cURL

curl --request POST \
  --url https://matcher.sandbox.lerian.net/v1/exceptions/callbacks/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "externalSystem": "stripe"
}
'

201

Example

{
  "createdAt": "<string>",
  "credentialId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "token": "<string>",
  "externalSystem": "<string>",
  "webhookUrlHint": "<string>"
}

Autorizaciones

Authorization · string · header · requerido

Bearer token authentication (format: "Bearer {token}")

Cuerpo

application/json

externalSystem · string

Optional operator-legible label for the external system this credential authenticates (e.g. "stripe", "billing-gw")

Maximum string length: 128

Ejemplo:

"stripe"

Respuesta

201

application/json

Created

createdAt · string · requerido

Mint time (RFC 3339, UTC)

credentialId · string<uuid> · requerido

Surrogate id of the minted credential

token · string · requerido

Raw bearer token, surfaced exactly once; configure it as the X-Callback-Token header value in the external system. Only its SHA-256 hash is stored server-side.

externalSystem · string

Operator-legible external-system label, echoed for confirmation

webhookUrlHint · string

Informational inbound-callback URL shape to configure in the external system. The {exceptionId} placeholder is filled per callback.