CPT subscription state change webhook

POST

/api/v1/subscriptions/callback

Inbound webhook called by CPT when subscription status changes.
Signature is verified by core-api using Ed25519 (CPT_CALLBACK_PUBLIC_KEY).
No JWT required — CPT calls this directly (bypasses Auth middleware).

Headers required:

x-api-key — CPT API key UUID

x-timestamp — Unix epoch (must be within ±300s of server time)

x-signature — Base64 Ed25519 signature over "{x-timestamp}.{normalizedJson}"

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Callback acknowledged

Bodyapplication/json

🟠400

🟠401

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/v1/subscriptions/callback' \
--header 'Content-Type: application/json' \
--data '{
    "subscriptionId": 0,
    "clientId": 0,
    "planCode": "string",
    "subscriptionStatus": 0,
    "dateEffective": "2019-08-24T14:15:22.123Z",
    "dateExpire": "2019-08-24T14:15:22.123Z",
    "seatCount": 0,
    "addons": [
        {
            "addonCode": "string",
            "addonValue": "string"
        }
    ],
    "additional": {}
}'

Response Example

{
    "success": true,
    "error": null
}

Modified at 2026-06-18 10:47:09

List CPT plans

Current active plan + items (flattened from CPT items[])