---
title: "Create a webhook"
method: POST
path: "/v1/webhooks"
tags: ["webhooks"]
---

# Create a webhook

`POST /v1/webhooks`

## Request

- Base URL: `https://botmail.pro`
- URL: `https://botmail.pro/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bm_session`

Scope: manage. Not for pending keys. `url` must be https
(`http://localhost` only in development). The response includes
`secret` once; store it to verify signatures.

## Request body

- object
  - `url` string, uri, required
  - `mailbox_id` string: Only this mailbox. Omit for every mailbox the credential can access.
  - `events` EventType[]: Default `["message.received"]`.

## Response `201`

Created.

- object
  - `id` string, required
  - `url` string, uri, required
  - `mailbox_id` string, nullable, required: Null = every mailbox.
  - `events` EventType[], required
  - `active` boolean, required
  - `failures` integer, required: Consecutive failures; disabled at 20.
  - `last_seq` integer, required: Last event delivered.
  - `disabled_reason` string, nullable, required
  - `created_at` string, date-time, required
  - `last_delivery_at` string, date-time, nullable, required
  - `secret` string, required: `whsec_…`. Shown only once.

## Other responses

- `400`: Invalid request (`bad_request` or a more specific code).
- `401`: Missing or invalid credentials (`unauthorized`, `invalid_token`).
- `403`: The credential can't do this (`forbidden`, `csrf`, `account_inactive`, …). Missing scopes are listed in `details.required_scope`; pending keys get a hint to wait for the claim.
- `404`: Not found or not accessible with this credential.
- `422`: Well-formed but rejected; see `code` and `hint`.

---

[API](https://skmtc.dev/botmail/apis/botmail-api.md) · [All operations](https://skmtc.dev/botmail/apis/botmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/botmail/apis/botmail-api/revisions/49f736362bf2?raw)