---
title: "Create a webhook endpoint"
method: POST
path: "/v1/webhooks"
tags: ["webhooks"]
---

# Create a webhook endpoint

`POST /v1/webhooks`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/webhooks`
- Auth: HTTP bearer

Create an endpoint. The response includes the signing secret once; after that, only a preview of it is available, since it is stored encrypted and cannot be retrieved in full. The endpoint URL is checked at creation and again before every delivery, since a hostname that resolved to a public address at save time could later be re-pointed at an internal address. Only `content.recalled` and `content.restored` events are actually sent today, even though the event catalog lists more.

The response carries the signing `secret` ONCE. Store it: later reads return only `secretPreview`.

**Notes.**
- Validation failures are 400 `bad_request`, where most other routes answer 422 `validation_error`.

## Request body

- object
  - `url` string, required: An https URL on the public internet (private and loopback hosts are refused).
  - `events` string[]: Events to deliver. Default: none. An unknown name is refused.
  - `description` string: Label; cut to 200 characters.

## Response `201`

Success.

- object
  - `data` object, required
    - `id` string, required: Webhook endpoint id.
    - `url` string, required: Where deliveries are POSTed.
    - `description` string, nullable, required
    - `secretPreview` string, required: First 8 characters of the signing secret.
    - `events` string[], required: Subscribed event names (see `GET /v1/webhooks/events`).
    - `enabled` boolean, required
    - `autoDisabledAt` string, nullable, required: ISO-8601 timestamp (UTC).
    - `autoDisabledReason` string, nullable, required
    - `consecutiveFailures` integer, required
    - `lastDeliveryAt` string, nullable, required: ISO-8601 timestamp (UTC).
    - `lastStatus` integer, nullable, required: HTTP status of the last delivery attempt.
    - `createdAt` string, required: ISO-8601 timestamp (UTC).
    - `updatedAt` string, required: ISO-8601 timestamp (UTC).
    - `secret` string, required: The HMAC signing secret (64 hex characters). Shown only in this response.

## Other responses

- `400`: `bad_request` (missing url, unknown event) or `unsafe_url`.
- `401`: Missing, expired or revoked bearer token.
- `403`: The token lacks the permission this operation needs (see `x-brix-permission`).
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)