---
title: "Create a scoped webhook subscription and reveal its signing secret once."
method: POST
path: "/api/v1/webhook-subscriptions"
tags: ["Webhooks"]
---

# Create a scoped webhook subscription and reveal its signing secret once.

`POST /api/v1/webhook-subscriptions`

## Request

- Base URL: `https://commentary.dev`
- URL: `https://commentary.dev/api/v1/webhook-subscriptions`
- Auth: HTTP bearer

Owner/admin only. HTTPS destinations are DNS-resolved and SSRF-checked. Idempotency-Key makes creation retry-safe.

## Headers

- `Idempotency-Key` string, required
- `X-Commentary-Workspace-Id` string
- `X-Correlation-Id` string

## Request body

- object
  - `endpointUrl` string, uri, required
  - `eventTypes` string[], required

## Response `201`

Successful response.

- object: The data.secret field is displayed only in this response.

## Other responses

- `400`: The request was invalid.
- `401`: Authentication is required.
- `403`: The token or session does not have permission for this resource.
- `404`: The resource was not found.
- `429`: The request was rate limited.

---

[API](https://skmtc.dev/commentary/apis/commentary-public-api.md) · [All operations](https://skmtc.dev/commentary/apis/commentary-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commentary/apis/commentary-public-api/revisions/7aaafc198c52?raw)