Create a webhook endpoint

Registers an HTTPS URL to receive signed event deliveries. The signing secret (whsec_...) is returned once in this response and never again — store it immediately. URLs must be HTTPS and pass the egress SSRF policy: DNS is resolved at connect time and private, link-local, and cloud-metadata ranges are rejected (re-checked on every redirect hop). Endpoint changes are audit-logged.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
uri
required

HTTPS required.

string
enabled_events
array of strings
Defaults to *
enabled_events
string
Headers
string
length ≤ 255

Any unique string (e.g. a UUID). Retries with the same key within 24h return the original response with Idempotent-Replayed: true. Same key + different body → 409.

Responses

Language
Credentials
Bearer
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json