> ## Documentation Index > Fetch the complete documentation index at: https://docs.engini.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create destination > THE SIGNING SECRET IN THE RESPONSE IS SHOWN ONCE AND CANNOT BE RETRIEVED AGAIN. Store it before discarding the response; if it is lost, call rotate-secret for a new one, which immediately invalidates the old. The URL must be https on a publicly routable host, and is re-checked immediately before every delivery - so a host that later resolves to a private address stops receiving events. The account's first destination becomes the default regardless of is_default. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/triggers/destinations openapi: 3.0.0 info: title: Engini DeveloperAPI version: v1 description: 'Merged public developer API spec: Identity + WorkflowApi.' servers: - url: https://api.engini.io security: - Bearer: [] - ApiKey: [] tags: - name: Auth description: Identify the caller a Developer API request is authenticated as. - name: Applications description: >- Discover the applications (toolkits) available in Engini and their connection requirements. - name: Tools description: Browse and execute the tools exposed by Engini applications. - name: Toolsets description: Manage toolsets - named groupings of connections and tools. - name: McpServers description: >- Inspect and maintain MCP servers - the account-wide endpoints that expose Engini tools and workflows over the Model Context Protocol. Distinct from the MCPClient connection kind, which is Engini consuming a third-party MCP server. - name: Connections description: >- Manage connections to applications, including OAuth sign-in and default-connection selection. - name: Triggers description: >- Create triggers that fire when something changes in a connected app, and manage the destinations their events are delivered to. paths: /v1/triggers/destinations: post: tags: - Triggers summary: Create destination description: >- THE SIGNING SECRET IN THE RESPONSE IS SHOWN ONCE AND CANNOT BE RETRIEVED AGAIN. Store it before discarding the response; if it is lost, call rotate-secret for a new one, which immediately invalidates the old. The URL must be https on a publicly routable host, and is re-checked immediately before every delivery - so a host that later resolves to a private address stops receiving events. The account's first destination becomes the default regardless of is_default. operationId: Triggers_CreateDestination parameters: [] requestBody: x-name: request description: The destination's name, url and optional settings. content: application/json: schema: $ref: '#/components/schemas/CreateTriggerDestinationRequest' required: true x-position: 1 responses: '201': description: The created destination, together with its one-time signing secret. content: application/json: schema: $ref: '#/components/schemas/TriggerDestinationCreated' '400': description: Bad request - malformed body or invalid parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized - missing or invalid bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden - the caller lacks access to the resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not found - the resource does not exist. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: A live destination in this account already uses that name. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Too many requests - rate limit exceeded. headers: Retry-After: description: Number of seconds to wait before retrying. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error - an unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - Bearer: [] - ApiKey: [] components: schemas: CreateTriggerDestinationRequest: type: object description: POST /v1/triggers/destinations. additionalProperties: false properties: name: type: string description: >- Slug matching ^[a-z0-9_-]{1,100}$. Reusing the name of a DELETED destination is allowed. nullable: true url: type: string description: >- An https URL on a publicly routable host. Re-validated before every delivery. nullable: true is_default: type: boolean description: >- Promote this destination to the account default, demoting the incumbent in the same transaction. Omitted or false leaves the current default alone - except on the account's FIRST destination, which becomes the default whatever this says (an account whose only destination is not the default would silently deliver nothing for every trigger created without one). nullable: true max_consecutive_failures: type: integer description: Defaults to 5. Must be at least 1. format: int32 nullable: true TriggerDestinationCreated: type: object description: >- The response to the three calls that MINT a secret: create, rotate-secret, and PUT /v1/triggers/destination when that call creates the account default. additionalProperties: false required: - destination properties: destination: description: The destination itself - identical to what every read path returns. oneOf: - $ref: '#/components/schemas/TriggerDestinationView' signing_secret: type: string description: >- The plaintext esec_… HMAC-SHA256 signing secret. Store it now; it is never shown again. ErrorResponse: type: object description: >- Unified error envelope for every non-200 response from /api/DeveloperAPI/v1/*. See applications-tools-spec.md §"Error envelope". additionalProperties: false required: - errorCode - message - requestId - timestamp - path properties: errorCode: type: string description: Machine-readable error code identifying the failure. message: type: string description: Human-readable error message. requestId: type: string description: Identifier of the request, for support/correlation. timestamp: type: string description: Timestamp when the error occurred (ISO 8601). path: type: string description: Request path that produced the error. details: type: array description: Per-field validation details, when applicable. nullable: true items: $ref: '#/components/schemas/ErrorDetail' TriggerDestinationView: type: object description: >- A named HTTP endpoint Engini delivers trigger events to. The signing secret is never included here - it is shown once, when the destination is created or its secret is rotated. additionalProperties: false required: - id - name - url - status properties: id: type: integer description: >- The numeric id, which is what POST /v1/triggers's destination_id takes. Routes address destinations by Name; this is here so a caller can bind a trigger to one without a second lookup. format: int32 name: type: string description: Slug, unique per account among live destinations. url: type: string is_default: type: boolean description: >- True on the one destination that receives events from triggers naming no destination. status: $ref: '#/components/schemas/TriggerDestinationStatusDTO' consecutive_failures: type: integer description: >- Consecutive DEAD-LETTERED events, not failed attempts. Reset to zero by any successful delivery and by re-enabling the destination. format: int32 max_consecutive_failures: type: integer description: How many consecutive dead-letters auto-disable this endpoint. format: int32 last_delivery_at: type: string format: date-time nullable: true last_failure_at: type: string format: date-time nullable: true last_failure: type: string description: >- Why the last delivery failed, sanitised for a tenant to read - a status code and reason, never a stack trace or an internal host. nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time nullable: true ErrorDetail: type: object description: A single field-level error detail within an ErrorResponse. additionalProperties: false required: - field - issue properties: field: type: string description: Name of the field the issue relates to. issue: type: string description: Description of the issue with the field. TriggerDestinationStatusDTO: type: string description: >- Whether a destination is currently accepting deliveries. Engini disables one automatically after too many consecutive failures; updating the destination enables it again. x-enumNames: - Active - AutoDisabled enum: - active - auto_disabled securitySchemes: Bearer: type: http description: Enter your JWT token scheme: bearer bearerFormat: JWT ApiKey: type: apiKey description: >- Opaque Developer API key (prefix `eng_`). Authenticates as the key's owner and resolves the account automatically. name: x-api-key in: header ````