---
title: "Add an endpoint. The signing secret is in the response, once."
method: POST
path: "/v1/webhooks/endpoints"
tags: ["webhooks"]
---

# Add an endpoint. The signing secret is in the response, once.

`POST /v1/webhooks/endpoints`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/webhooks/endpoints`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `webhooks:write`)

https only, public hosts only. Up to 10 endpoints on a personal account and 100 on a team. In a team, only the owner or an admin can add one. `apiVersion` defaults to the latest. An endpoint made with a key or OAuth grant is deleted when that key or grant is revoked. Zapier's REST hooks count against its connection (up to 50 each), not the account's limit.

## Request body

- WebhooksCreateRequest
  - `url` string, uri, required
  - `events` string[], required
  - `description` string
  - `filter` object
    - `projectIds` string[]
    - `labels` string[]
  - `apiVersion` '2026-10-10'

## Response `201`

OK

- WebhooksCreateResponse
  - `endpoint` WebhookEndpoint, required
    - `id` string, required
    - `url` string, uri, required
    - `events` string[], required
    - `secret` string, required
    - `createdAt` string, required
    - `lastDeliveryAt` string, nullable, required
    - `lastStatus` integer, nullable, required
    - `description` string, nullable
    - `enabled` boolean
    - `disabledReason` string, nullable
    - `disabledAt` string, nullable
    - `lastSuccessAt` string, nullable
    - `teamId` string, nullable
    - `apiVersion` '2026-10-10'
    - `filter` object, nullable
      - `projectIds` string[]
      - `labels` string[]
    - `previousSecret` object, nullable
      - `secret` string, required
      - `expiresAt` string, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)