---
title: "Creates a new webhook for an account"
method: POST
path: "/accounts/{account_id}/webhooks"
tags: ["Notifications Webhooks"]
---

# Creates a new webhook for an account

`POST /accounts/{account_id}/webhooks`

## Request

- Base URL: `https://api.cint.com/v1`
- URL: `https://api.cint.com/v1/accounts/{account_id}/webhooks`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/cint/apis/demand-api/docs/accounts/:account_id/webhooks/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a new webhook subscription for an account. This allows your application to receive real-time notifications for specific events.

## Request body

- object: The configuration for a new webhook subscription.
  - `url` string, url, required: The HTTPS endpoint where webhook notifications will be sent.
  - `events` WebhookEventType[], required: An array of webhook event type names.
  - `compression` 'gzip' | 'null', nullable: The compression applied to the body of every webhook request for this subscription. To receive compressed request bodies, set this field to `gzip`. Each request then carries the `Content-Encoding: gzip` header. The `Content-Type` header remains `application/json`, because compression changes only how the body is encoded, not its media type. Compression is not enabled by default. To receive uncompressed request bodies, omit this field, or set it to `null` or an empty string. Updating a webhook replaces the subscription, so an update that omits `compression` disables it. To keep compression enabled, include the field in every update.

## Response `201`

The webhook was created successfully.

**Important:** The `secret` is only returned on creation. You must store it securely, as you will need it to verify the signature of incoming webhook requests.

- WebhookCreated: The response object returned when a webhook is successfully created.
  - `id` string, ulid: The ID of the webhook.
  - `url` string, url: The HTTPS endpoint where webhook notifications will be sent.
  - `events` WebhookEventType[]: An array of webhook event type names.
  - `compression` 'gzip' | 'null', nullable: The compression applied to the body of every webhook request for this subscription. To receive compressed request bodies, set this field to `gzip`. Each request then carries the `Content-Encoding: gzip` header. The `Content-Type` header remains `application/json`, because compression changes only how the body is encoded, not its media type. Compression is not enabled by default. To receive uncompressed request bodies, omit this field, or set it to `null` or an empty string. Updating a webhook replaces the subscription, so an update that omits `compression` disables it. To keep compression enabled, include the field in every update.
  - `secret` string, base64: This is your webhook's secret signing key. You must use it to verify the authenticity and integrity of incoming webhook requests. Each webhook request includes a `Cint-Signature` header with two components: - `t` (timestamp): A Unix timestamp representing the time of the webhook call. - `v1` (signature v1): An HMAC SHA256 hash of the payload, generated by signing it with the secret key. The payload used to create the signature is the concatenation of the timestamp (`t`) and the request body, separated by a period (`.`). For example: - Payload: `1732526080.{"foo":"bar"}` - Example of `Cint-Signature` header: ```text Cint-Signature: t=1732526080,v1=6532d4777122acc32cd388763fc0c0ba8732698d09cf99eea086e5a86f8d3ebe ``` To verify the signature, you can use the following CLI command: ```bash $ export PAYLOAD='1732526080.{"foo":"bar"}' $ export SECRET=FP7UPZpATKBcYJj4va95PYud+a3gCidRERiLO+9MoFE= $ echo -n $PAYLOAD | openssl dgst -sha256 -hmac $SECRET # => (stdin)= 6532d4777122acc32cd388763fc0c0ba8732698d09cf99eea086e5a86f8d3ebe ``` If the subscription sets `compression`, the request body is compressed on the wire, but the signature still covers the uncompressed JSON, so this verification is unchanged.
  - `created_at` string, date-time: The timestamp when the webhook was created, in RFC3339 UTC format.
  - `updated_at` string, date-time: The timestamp when the webhook was last updated, in RFC3339 UTC format.

## Other responses

- `400`: A request is not valid and can't be processed.
- `401`: A request is unauthorized.
- `403`: A requested is forbidden.
- `500`: A request failed due to an internal error.

---

[API](https://skmtc.dev/cint/apis/demand-api.md) - [All operations](https://skmtc.dev/cint/apis/demand-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cint/apis/demand-api/revisions/077a4bdda5cb?raw)