> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Get a hub subscription > Returns a single tenant subscription. NEVER returns the signing secret (only create/rotate reveal it, once). ## OpenAPI ````yaml /pt/openapi/v3-current/consignado.yaml get /v1/subscriptions/{id} openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian Consignado — Dataprev. The API covers tenant credentials and rail configuration, worker margin, loan auctions and bids, contract registration and lifecycle, B3 instrument codes, disbursement confirmation, portability, refinancing, renegotiation, FGTS guarantees, reconciliation, funds, assignments, throughput, and event subscriptions. license: name: Lerian Studio General License title: Lerian Consignado API version: v1.0.0 servers: - url: https://br-consignado-gw.sandbox.lerian.net security: - BearerAuth: [] tags: - description: >- Per-tenant Dataprev credential custody and public rail configuration (upload, status, rotation, revoke, requester code, and worker portal base URL) name: Credentials - description: >- Per-tenant streaming-hub subscription control-plane (list, create, get, rotate, revoke, and test delivery) name: Subscriptions - description: >- Dataprev payroll-rail surface: FGTS balance and authorization reads, the FGTS guarantee execution, contract suspension, reactivation and term changes, the rail's own contract documents, and the on-demand reads of leilão solicitações, escriturações, repasses and employment terminations name: Consignado Rail - description: >- Synchronous rail command surface: the operations a bancarizador without the lender drives over HTTP. name: Consignado Rail Commands - description: >- Gateway-owned disbursement confirmation: a client bank recording money it has ALREADY paid to a worker. It crosses no government boundary and proxies no Dataprev operation. name: Consignado Disbursement - description: >- Per-tenant self-service outbound Dataprev rail throughput: read and set this tenant's own requests-per-second, including a deliberate pause at zero name: Consignado Throughput - description: >- The B3 instrument code (Código IF) of an averbado contract: informed once by the bancarizador after B3 registers the CCB, and read back name: Consignado Registro B3 paths: /v1/subscriptions/{id}: get: tags: - Subscriptions summary: Get a hub subscription description: >- Returns a single tenant subscription. NEVER returns the signing secret (only create/rotate reveal it, once). operationId: getSubscription parameters: - description: >- Bearer token. A tenant route relays it to the streaming-hub as server-to-server auth. in: header name: Authorization schema: description: >- Bearer token. A tenant route relays it to the streaming-hub as server-to-server auth. type: string - description: Subscription id. in: path name: id required: true schema: description: Subscription id. type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetResponse' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: GetResponse: additionalProperties: false properties: subscription: $ref: '#/components/schemas/SubscriptionRead' required: - subscription type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable product error code. One of the enumerated values: the CLT-NNNN catalog codes for the general refusal classes; the named command conflicts, which a client branches on to tell one conflict from another; the four terminal refusals IDEMPOTENCY_STATE_UNRECOGNISED, IDEMPOTENCY_RECORD_UNREADABLE, IDEMPOTENCY_OUTCOME_UNRECORDED and IDEMPOTENCY_REPLAY_UNAVAILABLE (422), which tell the client to reconcile the original request and never retry under a new key; IDEMPOTENCY_KEY_REUSE (422): the key is spent on a different request, so send a new key; the codes a single surface answers, named after it (FUNDO_*, REGISTRO_B3_*, ...); and the 5xx codes naming an upstream (DATAPREV_*, STREAMING_HUB_*, TENANT_MANAGER_*, the Access Manager's AUT-0033 and AUT-1021) or an unknown outcome, whose detail is client-readable; and the Access Manager's AUT-1022 (403): the partner credential holds more than one originador, so name it in the path. enum: - AUT-0033 - AUT-1021 - AUT-1022 - AVERBACAO_ARTIFACT_CONFLICT - AVERBACAO_CLAIM_CONFLICT - AVERBACAO_DOCUMENTATION_CONFLICT - AVERBACAO_EXCLUDED - AVERBACAO_HELD_BY_ANOTHER_SENDER - AVERBACAO_NOT_ACCEPTED - AVERBACAO_OPERATIONS_INTERNAL - AVERBACAO_OPERATIONS_INVALID_CURSOR - AVERBACAO_OPERATIONS_INVALID_QUERY - AVERBACAO_OPERATIONS_UNKNOWN_STATUS - AVERBACAO_OPERATION_NOT_FOUND - BID_NO_PROPOSTA_LEFT - BID_ORIGINADOR_INACTIVE - BID_ORIGINADOR_UNKNOWN - BID_PROPOSAL_SLOT_TAKEN - BID_SOLICITACAO_TAKEN - BID_SOLICITACAO_UNKNOWN - BID_SUBMISSIONS_INTERNAL - BID_SUBMISSIONS_INVALID_CURSOR - BID_SUBMISSIONS_UNKNOWN_SITUATION - BOOKING_FIELD_INVALID - CEDED_CREDIT_INTERNAL - CEDED_CREDIT_NO_FUND_ENTITLEMENT - CEDED_CREDIT_UNAVAILABLE - CLT-0001 - CLT-0002 - CLT-0003 - CLT-0004 - CLT-0005 - CLT-0006 - CLT-0007 - CLT-0008 - CLT-0009 - CLT-0010 - CLT-0011 - CONTRACT_ALREADY_REGISTERED - CONTRACT_NOT_BOOKABLE - CURSOR_EXPIRED - CURSOR_FENCE_MISMATCH - DATAPREV_CREDENTIAL_REJECTED - DATAPREV_CREDENTIAL_REQUIRED - DATAPREV_CREDENTIAL_REVOKED - DATAPREV_INVALID_RESPONSE - DATAPREV_TIMEOUT - DATAPREV_UNAVAILABLE - DECLARED_DATES_OUT_OF_ORDER - DECLARED_TERMS_INCONSISTENT - DISBURSEMENT_CONFIRMATIONS_INTERNAL - DISBURSEMENT_CONFIRMATIONS_INVALID_CURSOR - DISBURSEMENT_PAYMENT_CONFLICT - EVENT_DELIVERY_INTERNAL - EXCLUSION_AUTHORITY_CONFLICT - EXCLUSION_BOOKING_IDENTITY_INCOMPLETE - EXCLUSION_DOCUMENTATION_UNDERWAY - EXCLUSION_OPERATIONS_INTERNAL - EXCLUSION_OPERATIONS_INVALID_CURSOR - EXCLUSION_OPERATIONS_INVALID_QUERY - EXCLUSION_OPERATIONS_UNKNOWN_STATUS - EXCLUSION_OPERATION_NOT_FOUND - EXCLUSION_RENEGOTIATION_UNDERWAY - FGTS_EXECUTION_ALREADY_REFUSED - FGTS_EXECUTION_CONTRACT_TAKEN - FGTS_EXECUTION_OUTCOME_UNRESOLVED - FGTS_EXECUTION_PAYLOAD_MISMATCH - FIRST_DEDUCTION_BEFORE_COMPETENCIA - FORMALIZATION_DEADLINE_EXCEEDED - FUNDO_CNPJ_CONFLICT - FUNDO_DEACTIVATED - FUNDO_INTERNAL - FUNDO_INVALID_ID - FUNDO_INVALID_INPUT - FUNDO_NOT_FOUND - FUNDO_NOT_REGISTERED - FUNDO_REF_CONFLICT - FUNDO_UNAVAILABLE - HELD_REPASSE_MONTH_CLOSED - HELD_REPASSE_MONTH_MISMATCH - HELD_REPASSE_NOT_FOUND - HELD_REPASSE_UNATTRIBUTABLE - IDEMPOTENCY_KEY_REUSE - IDEMPOTENCY_OUTCOME_UNRECORDED - IDEMPOTENCY_RECORD_UNREADABLE - IDEMPOTENCY_REPLAY_UNAVAILABLE - IDEMPOTENCY_STATE_UNRECOGNISED - INVALID_CONTRACT_NUMBER - INVALID_CURSOR - INVALID_EVENTS_INVALID_CURSOR - INVALID_EVENT_NOT_FOUND - INVALID_EVENT_NOT_REQUEUEABLE - INVALID_PAGE_LIMIT - INVENTORY_UNAVAILABLE - LOAN_PRODUCT_VERSION_UNKNOWN - MARGIN_SNAPSHOT_INCONSISTENT - MATRICULA_DIFFERS_FROM_PROPOSAL - ORIGINADOR_INTERNAL - ORIGINADOR_INVALID_ID - ORIGINADOR_INVALID_INPUT - ORIGINADOR_NOT_FOUND - ORIGINADOR_REF_CONFLICT - ORIGINADOR_UNAVAILABLE - OUTCOME_UNKNOWN - PORTABILIDADE_WINDOW_EXPIRED - RAIL_COMMANDS_INTERNAL - RAIL_COMMANDS_INVALID_CURSOR - RAIL_COMMANDS_TENANT_REQUIRED - RAIL_COMMANDS_UNKNOWN_FILTER - RAIL_COMMAND_ALREADY_REFUSED - RAIL_COMMAND_ANSWER_NOT_RETAINED - RAIL_COMMAND_CLAIM_CONFLICT - RAIL_COMMAND_CLOSE_CONTRADICTED - RAIL_COMMAND_NOT_CLOSEABLE - RAIL_COMMAND_OUTCOME_UNRESOLVED - RAIL_COMMAND_PAYLOAD_MISMATCH - RATE_OUTSIDE_PRODUCT_RANGE - REGISTRATION_NOT_FOUND - REGISTRO_B3_AVERBACAO_NAO_CONFIRMADA - REGISTRO_B3_CONTRATO_NAO_ENCONTRADO - REGISTRO_B3_DATA_REGISTRO_INVALIDA - REGISTRO_B3_INTERNAL - REGISTRO_B3_JA_INFORMADO - REGISTRO_B3_NAO_INFORMADO - REGISTRO_B3_UNAVAILABLE - REGISTRO_B3_UNWIRED - RENEGOTIATION_EXCLUSION_UNDERWAY - REPASSE_EXPECTATIONS_INTERNAL - REPASSE_EXPECTATIONS_INVALID_CURSOR - REPASSE_EXPECTATIONS_UNKNOWN_SITUATION - REVERSAO_WINDOW_EXPIRED - SALDO_DEVEDOR_INTERNAL - SALDO_DEVEDOR_INVALID_CURSOR - SALDO_DEVEDOR_NOT_FOUND - SALDO_DEVEDOR_TENANT_REQUIRED - SALDO_DEVEDOR_UNAVAILABLE - STREAMING_HUB_TIMEOUT - STREAMING_HUB_UNAVAILABLE - TENANT_MANAGER_TIMEOUT - TENANT_MANAGER_UNAVAILABLE - THROUGHPUT_HISTORY_INTERNAL - THROUGHPUT_HISTORY_INVALID_CURSOR - THROUGHPUT_HISTORY_TENANT_REQUIRED - THROUGHPUT_HISTORY_UNAVAILABLE - THROUGH_REQUIRED - UNKNOWN_QUERY_PARAMETER - VERSION_ADMITS_NO_PESSOA_FISICA type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object SubscriptionRead: additionalProperties: false properties: created_at: description: RFC 3339 creation timestamp (UTC). examples: - '2026-01-15T12:00:00Z' format: date-time type: string credential_kind: description: >- Which credential this subscription delivers with: delegated_grant (a cross-account role; nothing stored, nothing to rotate), static_credential (a stored queue credential), signing_secret (a webhook signing secret), or none. enum: - signing_secret - static_credential - delegated_grant - none examples: - signing_secret type: string delegated_scope: description: >- Base64 of the subscription's delegated scope (this gateway's fund); absent on a tenant-wide subscription. examples: - Rk9ORE8tQQ== type: string enabled: description: Whether delivery is enabled. type: boolean endpoint_display: description: >- Show-safe rendering of the endpoint: webhook scheme+host only, queue/exchange/bus name only, pull:// unchanged. Empty when the stored endpoint cannot be parsed. This is the only rendering of the destination a READ carries; the full endpoint is served on its own route, GET /v1/subscriptions/{id}/endpoint, which the admin role alone may reach. examples: - https://hooks.example.com type: string event_majors: additionalProperties: format: int64 type: integer description: >- Per-event-type schema major, overriding schema_major for the types it names; absent means no overrides. examples: - loan_application.disbursed: 2 type: object event_types: description: Event-type filter; absent means all events. items: type: string type: - array - 'null' id: description: Hub-assigned subscription id (UUIDv7). examples: - 0192f1a0-0000-7000-8000-00000000c001 type: string name: description: Human-readable subscription name. examples: - orders-webhook type: string origin: description: >- The one producing application (ce-source) this subscription accepts events from; absent means any producer. examples: - midaz type: string plan_tier: description: Delivery plan tier. examples: - standard type: string schema_major: description: >- Event schema major delivered for every type event_majors does not name; absent means major 1. examples: - 2 format: int64 type: integer secret_configured: description: >- Whether stored secret material (a signing secret, or a queue sink's stored delivery credential) is present. Normally false for a delegated-grant sink, which stores none by design — but a grant row still holding a previously stored credential reads true, so read credential_kind for what actually delivers. The material itself is never returned. examples: - true type: boolean secret_overlap_until: description: >- RFC 3339 instant until which the PREVIOUS signing secret is still accepted (the hub dual-signs until then), or null when no rotation-overlap window is open: never rotated, the window already closed, or a sink kind that signs nothing. examples: - '2026-01-16T09:30:00Z' format: date-time type: - string - 'null' secret_rotated_at: description: >- RFC 3339 instant the stored secret material was last replaced, or null when the hub does not know (no secret stored, or a row predating the column that has not rotated since). examples: - '2026-01-15T09:30:00Z' format: date-time type: - string - 'null' signature_version: description: Webhook signature scheme version. examples: - 1 format: int64 type: integer sink_kind: description: Delivery sink kind. examples: - webhook type: string timeout_ms: description: >- Per-attempt delivery timeout in milliseconds; absent means the hub's default. examples: - 20000 format: int64 type: integer updated_at: description: RFC 3339 last-update timestamp (UTC). examples: - '2026-01-15T12:00:00Z' format: date-time type: string verification_state: description: Endpoint verification state. examples: - active type: string required: - endpoint_display - secret_configured - credential_kind - secret_rotated_at - secret_overlap_until - id - name - sink_kind - signature_version - plan_tier - enabled - verification_state - created_at - updated_at type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.