OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Signals API - Clients

Create a user

  • Sandbox: available
  • Staging: available
  • Production: unknown
POST
/v1/signals/api/user

Mints an API client. clientId and secret are the Basic credential, chosen by the caller and never returned. role may be v1's lowercase. A SUBSCRIBER needs webhookUrl and at least one event. It is on eventSchema 2 unless the body says 1: on 2 its first Standard Webhooks signing secret is returned this once as signingSecret; on 1 it needs webhookSecret (v1 called it secret). reach is attached (default: the patients attached to it, as v1's) or all (every patient of the tenant, those enrolled later included).

Through ovok

  • Who can call it: Manager apps, and users whose access policy grants the capabilities.
  • Capabilities, all required: signals_webhooks:update, signals_events:read. Project admins have every capability; client applications get no admin bypass.
  • Only subscribers are created through ovok, on event schema 2. ovok generates their id and Signals login, which they never use, and Signals generates the webhook signing secret.
  • It can reach any patient of your project without naming one, so it is for callers that reach every patient: project admins, manager or submitter apps, and anyone whose Patient access has no criteria.

Authorization

headerAuthorizationBearer <JWT>

Request Body

application/json
  1. body
role*"SUBSCRIBER"

Validated against the assignable roles rather than the full enum, so this MANAGER-gated route cannot mint a cross-tenant SUPER_ADMIN credential.

Value in"SUBSCRIBER"
name?string
Lengthlength <= 200
webhookUrl?string
Formaturi
events?array<string>
Items1 <= items
custom?string

v1's custom: an opaque string every webhook carries back as x-actimi-custom.

Lengthlength <= 1024
eventSchema?2

1 keeps v1's event names and bodies; 2, the default, sends one name per state change.

Value in2
reach?string

attached: the patients attached to it, as v1's; all: every patient of the tenant, later ones included.

Value in"attached""all"

Response Body

The user, without its secret; Location names it.

application/json
  1. response
id*string
tenantId*string
clientId*string
name*string
webhookUrl*string

Where alert webhooks are POSTed.

custom?string

v1's custom: an opaque string sent back on every webhook in the x-actimi-custom header. Absent when unset.

hasWebhookSecret*boolean

Whether v1's webhookSecret is set (event schema 1); a schema-2 subscriber signs with its Standard Webhooks secret instead. Never returned: it is write-only.

events*array<string>

Event patterns this client receives, e.g. alert.*.

eventSchema*number

Which names and bodies its webhooks use. 1: v1's, alert.trigger with refire and resolved flags. 2: one type per state change (alert.triggered, alert.refired, alert.resolved, …) in the Standard Webhooks envelope {type, timestamp, sequence, data}, the alert carrying its version.

Value in12
reach*string

A subscriber's patients: attached, those attached to it, as v1's; all, every patient of the tenant, those enrolled later included.

Value in"attached""all"
signingSecret?string

On a new event-schema-2 subscriber's create answer only: its first Standard Webhooks signing secret, returned this once. Rotate it with POST /api/subscriber/{id}/webhook/rotate-secret.

createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
_id*string

The same value as id.

role*string

The role in v1's lowercase.

tenant*string

The tenant id, under v1's name.

Example Request
curl -X POST 'https://api.sandbox.ovok.com/v1/signals/api/user' \  -H 'Content-Type: application/json' \  -d '{  "role": "SUBSCRIBER"}'
Example Response
{  "id": "string",  "tenantId": "string",  "clientId": "string",  "name": "string",  "webhookUrl": "string",  "custom": "string",  "hasWebhookSecret": true,  "events": [    "string"  ],  "eventSchema": 1,  "reach": "attached",  "signingSecret": "string",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "_id": "string",  "role": "string",  "tenant": "string"}

List users GET

The tenant's API clients, newest first, in v1's paginate envelope (`page`, `limit` defaulting to 10) with nest's `nextCursor`. `role` and `name` filter as in v1. ### Through ovok - **Who can call it:** Manager apps, and users whose access policy grants the capabilities. - **Capabilities, all required:** `signals_clients:read`. Project admins have every capability; client applications get no admin bypass.

Get one user GET

Without its secret, which is not retrievable. ### Through ovok - **Who can call it:** Manager apps, and users whose access policy grants the capabilities. - **Capabilities, all required:** `signals_clients:read`. Project admins have every capability; client applications get no admin bypass.