Skip to main content
POST
/
v1
/
webhook-endpoints
Create a webhook endpoint
curl --request POST \
  --url https://api.scrip.dev/v1/webhook-endpoints \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "enabled_events": [
    "balance.credited",
    "balance.debited"
  ],
  "url": "https://example.com/webhooks",
  "description": "Production webhook receiver",
  "metadata": "<unknown>"
}
'
{
  "created_at": "2026-01-15T10:30:00Z",
  "description": "Production webhook receiver",
  "enabled_events": [
    "balance.credited",
    "balance.debited"
  ],
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "metadata": "<unknown>",
  "secret": "whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
  "status": "ACTIVE",
  "updated_at": "2026-01-15T10:30:00Z",
  "url": "https://example.com/webhooks"
}
Registers a new webhook endpoint. You must provide an HTTPS URL and at least one event type (or * for all events). The response includes a secret starting with whsec_ — store it immediately, as it cannot be retrieved later. URLs are validated at creation time. The hostname must resolve to a public IP address. Private ranges, loopback addresses, and reserved hostnames (localhost, *.local, *.internal) are rejected.
For signature verification, event types, and payload shapes, see the Webhooks guide.

Authorizations

​
X-API-Key
string
header
required

API key passed in the X-API-Key header.

Body

application/json

Endpoint configuration

​
enabled_events
string[]
required

Event types to subscribe to (use * for all)

Minimum array length: 1
Example:
["balance.credited", "balance.debited"]
​
url
string
required

HTTPS URL that will receive webhook deliveries

Minimum string length: 1
Example:

"https://example.com/webhooks"

​
description
string

Human-readable label for this endpoint

Example:

"Production webhook receiver"

​
metadata
any

Arbitrary key-value metadata to attach to this endpoint

Response

Endpoint created (includes secret)

​
created_at
string<date-time>

When the endpoint was created

Example:

"2026-01-15T10:30:00Z"

​
description
string

Human-readable label

Example:

"Production webhook receiver"

​
enabled_events
string[]

Subscribed event types

Example:
["balance.credited", "balance.debited"]
​
id
string<uuid>

Endpoint ID

Example:

"550e8400-e29b-41d4-a716-446655440000"

​
metadata
any

Arbitrary metadata

​
secret
string

Signing secret (only returned on create and rotate — store it immediately)

Example:

"whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"

​
status
string

Lifecycle status: ACTIVE, DISABLED, or ARCHIVED

Example:

"ACTIVE"

​
updated_at
string<date-time>

When the endpoint was last modified

Example:

"2026-01-15T10:30:00Z"

​
url
string

Destination URL for deliveries

Example:

"https://example.com/webhooks"