> ## Documentation Index > Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt > Use this file to discover all available pages before exploring further. # Create event subscription > Sends machine events to an HTTPS endpoint you choose. Choose `topic` and `actions` from List event actions. `uri` can be at most 2,048 bytes, and `actions` at most 64 names of at most 64 bytes each. The response carries the subscription's signing key, `hmacKey`, which only this operation and Rotate signing key return: keep it to verify each delivery's signature. A name that already exists answers 409 and changes nothing. The subscription belongs to your account, not to whoever created it. Every account can use event subscriptions. In an account whose Macs your organization manages, they need the events capability. Service accounts can call it with the `compute:CreateEventSubscription` permission. ## OpenAPI ````yaml /api-reference/openapi/compute.json post /compute/v2/eventsubscriptions openapi: 3.0.3 info: title: Mount Thor Compute API version: 02a4a30e3ecb description: >- Create, list, inspect and delete virtual machines and bare-metal Macs, read the image and machine-class catalogs, see your reserved capacity and your account's compute profile, report machine problems to Mount Thor, and subscribe to machine events. Service-account credentials can list, create and delete machines, read the catalogs and the compute profile, and use event subscriptions. In an account whose Macs your organization manages, they can also read a Mac and use problem reports, and every one of these only as far as the account's capabilities allow. The other compute operations are for people using the `mthr` CLI or the portal. In an account whose Macs your organization manages, an operation outside its capabilities (see Get compute profile) answers 400 `tenant_compute_customer_managed`. Mount Thor names each machine. To change a machine's class or image, delete it and create a new one. Lists return one page at a time: pass `nextPageToken` back as `pageToken` until it comes back empty. servers: - url: https://customer-api.mountthor.com security: - bearerAuth: [] paths: /compute/v2/eventsubscriptions: post: summary: Create event subscription description: >- Sends machine events to an HTTPS endpoint you choose. Choose `topic` and `actions` from List event actions. `uri` can be at most 2,048 bytes, and `actions` at most 64 names of at most 64 bytes each. The response carries the subscription's signing key, `hmacKey`, which only this operation and Rotate signing key return: keep it to verify each delivery's signature. A name that already exists answers 409 and changes nothing. The subscription belongs to your account, not to whoever created it. Every account can use event subscriptions. In an account whose Macs your organization manages, they need the events capability. Service accounts can call it with the `compute:CreateEventSubscription` permission. operationId: ComputeService_CreateEventSubscription requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateEventSubscriptionRequest' required: true responses: '201': description: The subscription was created. content: application/json: schema: $ref: '#/components/schemas/CreateEventSubscriptionResponse' '400': description: >- The subscription was refused (`invalid_argument`): `name` is not a valid name, `topic` is not supported, `actions` are not valid for the topic or over their limit, or `uri` is over its limit or not an allowed HTTPS destination. Nothing was created. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: The credential is missing, invalid or expired. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- The credential does not allow this operation. `error.reason` is `machine_credential_not_supported` when the operation refuses service accounts. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: An event subscription with this name already exists. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Too many requests for now. Event subscription operations are limited per account; retry after the number of seconds in `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: >- With `error.reason` `unknown` (`error.status` `Unknown`), the subscription may have been created. Get it before retrying. If it exists, rotate its key, because its signing key cannot be read back. content: application/json: schema: $ref: '#/components/schemas/Error' '501': description: >- Event subscriptions are not available yet (`unimplemented`); retry later. content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Compute is temporarily unable to complete the request; retry later. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: CreateEventSubscriptionRequest: required: - eventSubscription type: object properties: eventSubscription: $ref: '#/components/schemas/EventSubscription' description: The subscription. `name`, `topic`, `actions` and `uri` are required. description: The subscription to create. CreateEventSubscriptionResponse: type: object properties: eventSubscription: allOf: - $ref: '#/components/schemas/EventSubscription' description: The subscription. hmacKey: type: string description: >- The subscription's signing key, base64-encoded. Only this response and Rotate signing key return it. Treat it as a secret. format: bytes description: The created subscription and its signing key. Error: type: object properties: error: type: object properties: code: type: integer description: The HTTP status code. status: type: string description: >- A short category name, for example `NotFound`, `InvalidArgument` or `FailedPrecondition`. reason: type: string description: >- A stable, machine-readable reason when one applies, for example `insufficient_funds` when a launch is refused for billing. Branch on this, not on `message`. message: type: string description: A human-readable explanation. Its wording can change. EventSubscription: required: - name - topic - actions - uri type: object properties: name: type: string description: >- The subscription's name, chosen by you and unique in your account: up to 253 lowercase letters, digits, hyphens and dots, starting and ending with a letter or digit. It cannot change. topic: enum: - EVENT_TOPIC_BARE_METAL_MACHINE - EVENT_TOPIC_VIRTUAL_MACHINE type: string description: >- The topic to subscribe to. Your Macs' events are under `EVENT_TOPIC_BARE_METAL_MACHINE`. format: enum actions: type: array items: type: string description: >- The actions to send, by name from List event actions for the chosen `topic`, or `["*"]` for every action of the topic, including actions added later. At least one. Order does not matter, and duplicates are ignored. uri: type: string description: >- The HTTPS URL that receives deliveries. Its host must be a public DNS name that resolves only to public addresses, on port 443, stated or by default. An IP address, a user name or password, or a fragment in the URL is refused. A path and a query are allowed. Redirects are not followed. createdAt: readOnly: true type: string description: When the subscription was created. format: date-time description: >- Which machine events Mount Thor sends, and where. Each delivery is signed with HMAC-SHA256, using the subscription's signing key, over the delivery's timestamp in decimal Unix seconds, a literal `.`, and the raw request body. Each attempt has a fresh timestamp and signatures. While an earlier key is retiring, each delivery carries a signature for each active key. Verify a signature with a key you trust, check that the timestamp is recent, and stop trusting a key once it retires. For the details of a delivery, ask your Mount Thor contact. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Send `Authorization: Bearer ` to https://customer-api.mountthor.com. People use the session that `mthr login` stores (a token starting `mt_session_`, valid for up to 12 hours). Automation uses a service-account credential (starting `mt_sa_v1_`, valid for 90 days) from Create credential. Each operation names the permission it needs. Service accounts hold permissions through custom roles, and some operations refuse them; those operations say so. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.