create_watch
Subscribe to a legal board via webhook or email to receive automatic updates when it changes. Includes SSRF protection and delivery IDs for reliable deduplication.
Instructions
Subscribe to a board. webhookUrl is validated against an SSRF blocklist (loopback/private/link-local/cloud-metadata ranges) before acceptance and again on every dispatch. Every board.updated delivery body includes a deliveryId (stable per watch per refresh event, even across our own internal retries) so you can dedup safely on your end.
Free.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| state | No | Board's state (lowercase 2-letter), or omit for a federal board. Must match the `state` GET /boards returned for this corpusType. | |
| channel | No | webhook | |
| corpusType | Yes | Board's corpus_type (e.g. `state`, `state_regulation`, `federal_register`, `agency_guidance`). Call GET /boards first for the authoritative, current list -- corpus_type is a growing set as new corpora are added, not a fixed enum. | |
| webhookUrl | No | Required when channel is webhook or both. | |
| webhookAuth | No | Optional outbound credential sent on every delivery, so your gateway can authenticate us with the header it already reads. Independent of `webhookSecret`: set neither, either, or both. Only valid on a webhook or both channel watch. | |
| emailAddress | No | Required when channel is email or both. | |
| webhookSecret | No | Optional signing secret, stored encrypted and never returned. When set, every delivery carries an `X-Vaquill-Signature: sha256=<hex>` header: HMAC-SHA256 of the raw request body bytes, keyed with this secret. To verify, compute the same HMAC over the raw body you received (before parsing JSON) and compare it, constant-time, to the hex digest after `sha256=`. |