---
title: "Create a signed, retried destination or idempotent inbound event source."
method: POST
path: "/v1/workspaces/{workspaceId}/webhooks"
---

# Create a signed, retried destination or idempotent inbound event source.

`POST /v1/workspaces/{workspaceId}/webhooks`

## Request

- Base URL: `https://api.bangermail.com`
- URL: `https://api.bangermail.com/v1/workspaces/{workspaceId}/webhooks`
- Auth: HTTP bearer

## Request body

- CreateProductWebhookRequest
  - `kind` 'outbound' | 'inbound', required
  - `name` string, required
  - `source_key` string: banger_api is reserved for the webhook POST /events creates.
  - `source_config` object: Source-specific deterministic event evaluation and delivery mapping. Supported for Zendesk and Supabase Auth.
    - `vip_tags` string[]
    - `sla_warning_minutes` integer
    - `project_url` string, uri: Supabase project URL.
    - `mailbox_id` string, uuid: Active Banger sending address used for Supabase Auth email.
    - `template_ids` object: Banger template selected for each Supabase Auth email action.
      - `signup` string, uuid, required
      - `invite` string, uuid, required
      - `magiclink` string, uuid, required
      - `recovery` string, uuid, required
      - `email_change` string, uuid, required
      - `reauthentication` string, uuid, required
      - `password_changed_notification` string, uuid, required
      - `email_changed_notification` string, uuid, required
      - `phone_changed_notification` string, uuid, required
      - `identity_linked_notification` string, uuid, required
      - `identity_unlinked_notification` string, uuid, required
      - `mfa_factor_enrolled_notification` string, uuid, required
      - `mfa_factor_unenrolled_notification` string, uuid, required
  - `signing_secret` string: Supabase Send Email Hook secret. Accepted only for an inbound Supabase source and encrypted at rest.
  - `endpoint_url` string, uri: Required for outbound destinations only.
  - `event_types` string[]: Events to send. Omitted, an outbound endpoint gets the default activity events; the specific events (mail.received, mail.sent, send.*, journey.*) are sent only when listed. * sends everything, including the high-volume send.delivered.

## Response `201`

Webhook created. Outbound signing secrets are shown once; inbound credential options can be reopened by authorized callers.

- object
  - `data` CreatedProductWebhook, required
    - `id` string, uuid, required
    - `kind` 'outbound' | 'inbound', required
    - `source_key` string, required
    - `name` string, required
    - `endpoint_url` string, uri, nullable
    - `status` 'active' | 'disabled' | 'error', required
    - `event_types` string[], required
    - `connection_id` string, uuid, nullable
    - `delivered_count` integer, required
    - `failed_count` integer, required
    - `last_delivered_at` string, date-time, nullable
    - `last_received_at` string, date-time, nullable
    - `last_error_code` string, nullable
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `signing_secret` string: Outbound request signing secret
    - `source_url` string, uri: Inbound event URL containing its unguessable secret.
    - `webhook_url` string, uri: Public inbound URL to use with the Authorization header.
    - `bearer_token` string: Secret endpoint token to send as Authorization Bearer.

## Other responses

- `409`: webhook_name_taken. The product already has a webhook of this kind with this name, disabled ones included. Choose another name or delete the existing webhook.

---

[API](https://skmtc.dev/bangermail/apis/banger-api.md) · [All operations](https://skmtc.dev/bangermail/apis/banger-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bangermail/apis/banger-api/revisions/a149909267f9?raw)