---
title: "Create an inbound webhook endpoint"
method: POST
path: "/agents/{agentId}/webhooks"
tags: ["Agent Webhooks"]
---

# Create an inbound webhook endpoint

`POST /agents/{agentId}/webhooks`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/agents/{agentId}/webhooks`
- Auth: HTTP bearer

Returns the endpoint URL and its token ONCE. Every provider but `none` requires `verificationSecret`.

## Path parameters

- `agentId` string, uuid, required

## Request body

- object
  - `name` string, required
  - `provider` 'none' | 'shared_secret' | 'hmac_generic' | 'standard_webhooks' | 'stripe' | 'github'
  - `verificationSecret` string
  - `signatureConfig` object
  - `filters` WebhookFilter[]
    - `field` string, required
    - `op` 'eq' | 'neq' | 'in' | 'exists' | 'contains', required
    - `value` union
      - string
      - string[]
  - `maxPayloadBytes` integer, nullable
  - `rateLimitPerMinute` integer, nullable
  - `dailyTurnQuota` integer, nullable

## Response `201`

- object
  - `endpoint` AgentWebhookEndpoint, required: Never carries the full URL token nor the verification secret.
    - `id` string, uuid, required
    - `name` string, required
    - `status` 'active' | 'paused' | 'disabled', required
    - `provider` 'none' | 'shared_secret' | 'hmac_generic' | 'standard_webhooks' | 'stripe' | 'github' | 'custom', required
    - `tokenPrefix` string, required
    - `hasVerificationSecret` boolean
    - `signatureConfig` object, nullable
    - `filters` WebhookFilter[]
      - `field` string, required
      - `op` 'eq' | 'neq' | 'in' | 'exists' | 'contains', required
      - `value` union
        - string
        - string[]
    - `maxPayloadBytes` integer, nullable
    - `rateLimitPerMinute` integer, nullable
    - `dailyTurnQuota` integer, nullable
    - `totalEventsCount` integer
    - `rejectedRequestsCount` integer
    - `lastRejectedAt` string, date-time, nullable
    - `lastRejectedCode` integer, nullable
    - `lastEventAt` string, date-time, nullable
    - `createdAt` string, date-time
  - `url` string, required
  - `token` string, required

## Other responses

- `400`: VALIDATION_FAILED / PROVIDER_NOT_AVAILABLE / PROVIDER_HAS_NO_SECRET / EVENT_NOT_REQUEUEABLE
- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: FORBIDDEN / PLAN_WEBHOOK_DISABLED
- `404`: AGENT_NOT_FOUND / ENDPOINT_NOT_FOUND / EVENT_NOT_FOUND
- `409`: AGENT_INACTIVE

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)