---
title: "Create company webhook"
method: POST
path: "/companies/{id}/webhooks"
tags: ["Companies"]
---

# Create company webhook

`POST /companies/{id}/webhooks`

## Request

- Base URL: `https://api.100hires.com/v2`
- URL: `https://api.100hires.com/v2/companies/{id}/webhooks`
- Auth: HTTP bearer

Creates a company-scoped webhook subscription. Use for outbound company-level event integrations.

## Path parameters

- `id` integer, required

## Request body

- WebhookCreateRequest
  - `url` string, required: Webhook destination URL. Must be HTTPS.

## Response `200`

Created webhook. `signing_secret` is returned only here — store it securely.

- WebhookWithSecret
  - `id` integer: Unique identifier
  - `url` string: Endpoint URL that receives webhook event payloads
  - `signing_secret` string: HMAC-SHA256 signing secret for this webhook, used to verify the `x-hires-signature-v2` header. Returned ONLY in create and rotate-secret responses — store it securely, it is never shown again.

## Other responses

- `400`: Validation error
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `415`: Content-Type must be application/json
- `429`: Too many requests

---

[API](https://skmtc.dev/100hires/apis/100hires-api.md) · [All operations](https://skmtc.dev/100hires/apis/100hires-api/llms.txt) · [OpenAPI document](https://skmtc.dev/100hires/apis/100hires-api/revisions/e63e2d3115f7?raw)