---
title: "Create Webhook"
method: POST
path: "/webhooks"
tags: ["webhooks"]
---

# Create Webhook

`POST /webhooks`

## Request

- Base URL: `https://api.coinvoyage.io/v3`
- URL: `https://api.coinvoyage.io/v3/webhooks`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/coinvoyage/apis/coinvoyage-api-v3/docs/webhooks/post.ts> (a function with typed inputs; its response is checked against the schema)

Register a webhook endpoint. Each delivery is a POST with headers X-Event-ID, X-Event-Type, CoinVoyage-Webhook-Signature: base64(HMAC-SHA256(webhook_secret, raw body)), CoinVoyage-Webhook-Timestamp: unix seconds at the moment of the send attempt (it changes on every retry), and CoinVoyage-Webhook-Signature-V2: base64(HMAC-SHA256(webhook_secret, timestamp + "." + raw body)) using the exact CoinVoyage-Webhook-Timestamp value. Verify Signature-V2 and reject timestamps outside your tolerance to prevent replays; CoinVoyage-Webhook-Signature is unchanged and kept for existing integrations.

## Headers

- `Authorization-Signature` string, required

## Request body

- CreateWebhookRequest
  - `url` string, required
  - `subscription_events` string[]

## Response `201`

Webhook created

- WebhookResponse
  - `id` string, required
  - `url` string, required
  - `webhook_secret` string
  - `subscription_events` string[]
  - `active` boolean, required

## Other responses

- `400`: Invalid webhook URL
- `401`: Unauthorized
- `422`: Invalid request body
- `500`: Internal Server Error

---

[API](https://skmtc.dev/coinvoyage/apis/coinvoyage-api-v3.md) - [All operations](https://skmtc.dev/coinvoyage/apis/coinvoyage-api-v3/llms.txt) - [OpenAPI document](https://skmtc.dev/coinvoyage/apis/coinvoyage-api-v3/revisions/3535f46f4c27?raw)