CreateEventPipelineAPI mirrors erdo_create_event_pipeline. Creation is where
the inbound source and auth are set; dataset.write targets are referenced by slug (a well-formed same-org slug that doesn’t exist yet is auto-created and reported in created_datasets), and the generated verification secret for the secret-bearing auth modes is returned exactly once, on this response.
Authorizations
An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).
Body
authenticated_viewer, header for shared_secret_header). For the secret-bearing modes an omitted secret is generated server-side.
Response
Success response
is stripped by toPipeline. The secret is surfaced only once, at create and rotate, via the Secret field below.
auto-created because they didn't exist yet. Populated only on the create and update responses (like Secret), empty on list/get — the creation must be visible to the caller, not silent.
user/agent-authored ones: "custom" (the default) or "page_events" (the per-page first-party analytics pipeline).
create and rotate responses (empty on list/get). It is a bearer-equivalent credential, so it is encore:"sensitive" (kept out of request traces).
to (its dataset.write actions) — a convenience view of where the pipeline's output lands, parsed from Pipeline. Generic config, not tied to any use case.

