---
title: "Create a webhook"
method: POST
path: "/v1/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /v1/webhooks`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/webhooks`
- Auth: HTTP bearer

Registers a new webhook endpoint to receive real-time events. Choose a source (messaging / user / account_status / post) and supply the target URL. The HMAC signing secret is returned exactly once in the 201 response, store it securely.

## Request body

- union
  - object
    - `source` 'messaging', required
    - `request_url` string, required: HTTPS URL that receives webhook deliveries. Must be a publicly reachable host on the default https port; private, loopback and link-local addresses are rejected.
    - `name` string: Human-readable name for this webhook (1-100 chars)
    - `account_ids` string[], required: Per-account targeting. Required and non-empty; each id must be an acc_-prefixed id owned by the tenant.
    - `enabled` boolean: A disabled webhook is created but delivers nothing
    - `headers` object[]: Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
      - `key` string, required
      - `value` string, required
    - `events` string[]: Messaging events to subscribe to (default: [message.received])
    - `data` string[]: Field-remapping keys for the messaging delivery payload
  - object
    - `source` 'user', required
    - `request_url` string, required: HTTPS URL that receives webhook deliveries. Must be a publicly reachable host on the default https port; private, loopback and link-local addresses are rejected.
    - `name` string: Human-readable name for this webhook (1-100 chars)
    - `account_ids` string[], required: Per-account targeting. Required and non-empty; each id must be an acc_-prefixed id owned by the tenant.
    - `enabled` boolean: A disabled webhook is created but delivers nothing
    - `headers` object[]: Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
      - `key` string, required
      - `value` string, required
    - `events` string[]: User/relation events to subscribe to (default: [connection.accepted])
    - `data` string[]: Field-remapping keys for the user/relation delivery payload
  - object
    - `source` 'account_status', required
    - `request_url` string, required: HTTPS URL that receives webhook deliveries. Must be a publicly reachable host on the default https port; private, loopback and link-local addresses are rejected.
    - `name` string: Human-readable name for this webhook (1-100 chars)
    - `account_ids` string[]: Per-account targeting. Omit to receive events for every current and future account; each id must be an acc_-prefixed id you own.
    - `enabled` boolean: A disabled webhook is created but delivers nothing
    - `headers` object[]: Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
      - `key` string, required
      - `value` string, required
    - `events` string[]: Account-status events to subscribe to (default: all 12 lifecycle events)
  - object
    - `source` 'post', required
    - `request_url` string, required: HTTPS URL that receives webhook deliveries. Must be a publicly reachable host on the default https port; private, loopback and link-local addresses are rejected.
    - `name` string: Human-readable name for this webhook (1-100 chars)
    - `account_ids` string[], required: Per-account targeting. Required and non-empty; each id must be an acc_-prefixed id owned by the tenant.
    - `enabled` boolean: A disabled webhook is created but delivers nothing
    - `headers` object[]: Custom headers added to each delivery POST. Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
      - `key` string, required
      - `value` string, required
    - `events` string[]: Post events to subscribe to (default: both post.published and post.publish_failed)

## Response `201`

Webhook registered. The HMAC signing secret is returned exactly once, store it immediately.

- object
  - `object` 'webhook': Response type discriminator.
  - `id` string: Webhook id (wh_-prefixed ULID).
  - `source` 'messaging' | 'user' | 'account_status' | 'post': The event source this webhook subscribes to.
  - `request_url` string: The URL that receives delivery POST requests.
  - `name` string, nullable: Human-readable label.
  - `account_ids` string[], nullable: Accounts targeted by this webhook (acc_ ids you own), or null when an account_status webhook covers every current and future account.
  - `enabled` boolean: A disabled webhook is created but delivers nothing.
  - `headers` object[]: Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value.
    - `key` string: The header name, as configured.
    - `value_fingerprint` string, nullable: A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured.
  - `events` string[]: Canonical event names this webhook subscribes to.
  - `data` string[]: Field-remapping keys for the delivery payload (messaging and user sources only; post and account_status have none).
  - `secret` string: HMAC signing secret, 64 hexadecimal characters, returned exactly once at creation. Store it securely.
  - `secret_prefix` string: The first 8 characters of the secret, for identification without exposing it. Exactly the value the read endpoints return for this webhook.
  - `created_at` string: ISO-8601 creation timestamp.
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `400`: Invalid request, malformed URL, empty events array, or event-source mismatch.
- `401`: Missing or invalid API key.
- `402`: Payment required, an active subscription is needed.
- `404`: One or more account_ids not found for this tenant.
- `413`: Payload too large, the request body exceeds the size limit.
- `429`: Rate limited, slow down and retry after the hinted delay.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)