Skip to main content
POST
Create a webhook endpoint
Registers a new webhook endpoint. You must provide an HTTPS URL and at least one event type (or * for all events). The response includes a secret starting with whsec_; store it immediately, as it cannot be retrieved later. URLs are validated at creation time. The hostname must resolve to a public IP address. Private ranges, loopback addresses, and reserved hostnames (localhost, *.local, *.internal) are rejected.
For signature verification, event types, and payload shapes, see the Webhooks guide.

Authorizations

X-API-Key
string
header
required

API key passed in the X-API-Key header.

Body

application/json

Endpoint configuration

enabled_events
string[]
required

Event types to subscribe to (use * for all)

Minimum array length: 1
Example:
url
string
required

HTTPS URL that will receive webhook deliveries

Minimum string length: 1
Example:

"https://example.com/webhooks"

description
string

Human-readable label for this endpoint

Example:

"Production webhook receiver"

metadata
any

Arbitrary key-value metadata to attach to this endpoint

Response

Endpoint created (includes secret)

circuit_broken_until
string

When set and in the future, the circuit breaker has paused deliveries to this endpoint until this time (sustained delivery failures)

Example:

"2026-01-15T10:40:00Z"

created_at
string<date-time>

When the endpoint was created

Example:

"2026-01-15T10:30:00Z"

description
string

Human-readable label

Example:

"Production webhook receiver"

enabled_events
string[]

Subscribed event types

Example:
id
string<uuid>

Endpoint ID

Example:

"550e8400-e29b-41d4-a716-446655440000"

metadata
any

Arbitrary metadata

rate_limited_until
string

When set and in the future, 429 rate-limit backoff has paused deliveries to this endpoint until this time

Example:

"2026-01-15T10:35:00Z"

secret
string

Signing secret (only returned on create and rotate — store it immediately)

Example:

"whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"

status
string

Lifecycle status: ACTIVE, DISABLED, or ARCHIVED

Example:

"ACTIVE"

updated_at
string<date-time>

When the endpoint was last modified

Example:

"2026-01-15T10:30:00Z"

url
string

Destination URL for deliveries

Example:

"https://example.com/webhooks"