Skip to main content
Scope: webhooks:manage  ·  Idempotency-Key: not accepted
string
required
An https:// URL that resolves to a public address. Loopback, link-local and private addresses are refused.
string[]
required
At least one event type from the catalog, or ["*"] for all.
string
A note for your team.

Response

201 with the endpoint and its secret (whsec_...). This is the only time the full secret is returned; afterwards only secretLast4 is shown. Store it as a credential. The route takes no Idempotency-Key, because a replay would have to store and return the secret again. If a create times out, call GET /v1/webhook-endpoints before you create another.