---
title: "Create a specific webhook in a repository."
method: POST
path: "/webhooks/{owner}/{repo}/"
tags: ["webhooks"]
---

# Create a specific webhook in a repository.

`POST /webhooks/{owner}/{repo}/`

Create a specific webhook in a repository.

## Request body

- RepositoryWebhookRequest
  - `events` string[], nullable, required
  - `is_active` boolean — If enabled, the webhook will trigger on subscribed events and send payloads to the configured target URL.
  - `package_query` string, nullable — The package-based search query for webhooks to fire. This uses the same syntax as the standard search used for repositories, and also supports boolean logic operators such as OR/AND/NOT and parentheses for grouping. If a package does not match, the webhook will not fire.
  - `request_body_format` 0 | 1 | 2 | 3 — The format of the payloads for webhook requests. Valid options are: (0) JSON, (1) JSON array, (2) form encoded JSON and (3) Handlebars template.
  - `request_body_template_format` 0 | 1 | 2 — The format of the payloads for webhook requests. Valid options are: (0) Generic/user defined, (1) JSON and (2) XML.
  - `request_content_type` string, nullable — The value that will be sent for the 'Content Type' header.
  - `secret_header` string, nullable — The header to send the predefined secret in. This must be unique from existing headers or it won't be sent. You can use this as a form of authentication on the endpoint side.
  - `secret_value` string, nullable — The value for the predefined secret (note: this is treated as a passphrase and is encrypted when we store it). You can use this as a form of authentication on the endpoint side.
  - `signature_key` string — The value for the signature key - This is used to generate an HMAC-based hex digest of the request body, which we send as the X-Cloudsmith-Signature header so that you can ensure that the request wasn't modified by a malicious party (note: this is treated as a passphrase and is encrypted when we store it).
  - `target_url` string, uri, required — The destination URL that webhook payloads will be POST'ed to.
  - `templates` WebhookTemplate[], nullable, required
    - `event` string, required
    - `template` string, nullable
  - `verify_ssl` boolean — If enabled, SSL certificates is verified when webhooks are sent. It's recommended to leave this enabled as not verifying the integrity of SSL certificates leaves you susceptible to Man-in-the-Middle (MITM) attacks.

## Response `201`

Created the specified webhook

- RepositoryWebhook
  - `created_at` string, date-time
  - `created_by` string
  - `created_by_url` string, uri
  - `disable_reason` 0 | 1 | 2 | 3 | 4 | 5 | 6
  - `disable_reason_str` string
  - `events` string[], nullable, required
  - `identifier` integer, nullable — Deprecated (23-05-15): Please use 'slug_perm' instead. Previously: A monotonically increasing number that identified a webhook request within a repository.
  - `is_active` boolean — If enabled, the webhook will trigger on subscribed events and send payloads to the configured target URL.
  - `is_last_response_bad` boolean
  - `last_response_status` integer
  - `last_response_status_str` string
  - `num_sent` integer
  - `package_query` string, nullable — The package-based search query for webhooks to fire. This uses the same syntax as the standard search used for repositories, and also supports boolean logic operators such as OR/AND/NOT and parentheses for grouping. If a package does not match, the webhook will not fire.
  - `request_body_format` 0 | 1 | 2 | 3 — The format of the payloads for webhook requests. Valid options are: (0) JSON, (1) JSON array, (2) form encoded JSON and (3) Handlebars template.
  - `request_body_format_str` string
  - `request_body_template_format` 0 | 1 | 2 — The format of the payloads for webhook requests. Valid options are: (0) Generic/user defined, (1) JSON and (2) XML.
  - `request_body_template_format_str` string
  - `request_content_type` string, nullable — The value that will be sent for the 'Content Type' header.
  - `secret_header` string, nullable — The header to send the predefined secret in. This must be unique from existing headers or it won't be sent. You can use this as a form of authentication on the endpoint side.
  - `self_url` string, uri
  - `slug_perm` string, slug
  - `target_url` string, uri, required — The destination URL that webhook payloads will be POST'ed to.
  - `templates` WebhookTemplate[], nullable, required
    - `event` string, required
    - `template` string, nullable
  - `updated_at` string, date-time
  - `updated_by` string
  - `updated_by_url` string, uri
  - `verify_ssl` boolean — If enabled, SSL certificates is verified when webhooks are sent. It's recommended to leave this enabled as not verifying the integrity of SSL certificates leaves you susceptible to Man-in-the-Middle (MITM) attacks.

## Other responses

- `400` — Request could not be processed (see detail).
- `404` — Owner namespace or repository not found
- `422` — Missing or invalid parameters (see detail).

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api-v1/revisions/4d7879df9b2f/schema)