---
title: "Register an admission endpoint"
method: POST
path: "/api/hook-endpoints"
tags: ["HookEndpoints"]
---

# Register an admission endpoint

`POST /api/hook-endpoints`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/api/hook-endpoints`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `token`

The URL must be https without credentials. It is resolved and checked against private, loopback and link-local ranges on every call, and the connection is pinned to the validated address. The signing secret is returned once, in this response.

## Request body

- HookEndpointInput
  - `name` string, required
  - `url` string, uri, required: https only, no credentials
  - `enabled` boolean
  - `priority` integer
  - `ops` string[]
  - `timeoutMs` integer
  - `failMode` 'closed' | 'open': What a failed call means on a single write.
  - `bulkFailMode` 'open' | 'closed': What a failed call means on a bulk write.

## Response `201`

Created endpoint plus its secret.

- object
  - `name` string, required
  - `url` string, uri, required: https only, no credentials
  - `enabled` boolean
  - `priority` integer
  - `ops` string[]
  - `timeoutMs` integer
  - `failMode` 'closed' | 'open': What a failed call means on a single write.
  - `bulkFailMode` 'open' | 'closed': What a failed call means on a bulk write.
  - `id` integer
  - `contentGrant` 'text' | 'attributes', nullable
  - `createdAt` string, date-time
  - `updatedAt` string, date-time
  - `secret` string

## Other responses

- `400`: Request body/query failed Zod validation.
- `401`: Missing or invalid credentials.
- `403`: Admin or owner role (or an API key with admin scope) required, or the plan lacks the webhooks feature.
- `409`: The tenant already holds the maximum of 10 endpoints.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)