---
title: "Create webhook profile token"
method: POST
path: "/dags/{fileName}/webhook/profile-tokens"
tags: ["webhooks"]
---

# Create webhook profile token

`POST /dags/{fileName}/webhook/profile-tokens`

## Request

- Base URL: `http://localhost/api/v1`
- URL: `http://localhost/api/v1/dags/{fileName}/webhook/profile-tokens`
- Auth: one of:
  - HTTP bearer
  - HTTP basic
  - none

Creates an additional webhook token bound to one runtime profile.
Requests authenticated with it always run with that profile.
Returns the new token, which is only shown once. Not available when
the webhook auth mode is `hmac_only`. Admin only.

## Path parameters

- `fileName` string, regex, required: Name of the DAG file

## Query parameters

- `remoteNode` string

## Request body

- WebhookProfileTokenCreateRequest: Request to create a webhook profile token
  - `name` string, required: Label identifying the caller that will hold the token
  - `profile` string, required: Runtime profile name.

## Response `201`

Profile token created successfully

- WebhookCreateResponse: Response when creating or regenerating a webhook (includes full token)
  - `webhook` WebhookDetails, required: Webhook configuration details (token not included)
    - `id` string, uuid, required: Unique identifier for the webhook
    - `dagName` string, required: Name of the DAG this webhook triggers
    - `tokenPrefix` string, required: First 8 characters of the token for identification
    - `enabled` boolean, required: Whether the webhook is active
    - `authMode` 'token_only' | 'token_and_hmac' | 'hmac_only', required: Authentication mode for a webhook trigger endpoint
    - `hmac` WebhookHMACDetails, required: Public webhook HMAC configuration details
      - `enabled` boolean, required: Whether HMAC authentication is currently enabled
      - `enforcementMode` 'strict' | 'observe': How HMAC validation is enforced when HMAC is enabled
      - `algorithm` string: Fixed HMAC algorithm for v1
      - `headerName` string: Header containing the HMAC signature
      - `format` string: Expected signature header value format
      - `secretConfigured` boolean, required: Whether an HMAC secret is configured for the webhook
      - `updatedAt` string, date-time: When the HMAC secret was last generated
    - `profileSelection` WebhookProfileSelectionDetails, required: Runtime profiles that webhook callers may select
      - `allowedProfiles` RuntimeProfileName[], required: Runtime profile names accepted through X-Dagu-Profile. An empty list disables caller selection.
    - `profileTokens` WebhookProfileToken[]: Additional tokens, each bound to one runtime profile. Remote nodes running versions without profile tokens omit the field.
      - `id` string, required: Unique identifier for the profile token
      - `name` string, required: Label identifying the caller that holds the token
      - `tokenPrefix` string, required: Leading characters of the token for identification
      - `profile` string, required: Runtime profile name.
      - `createdAt` string, date-time, required: When the profile token was created
      - `createdBy` string: User ID who created the profile token
      - `lastUsedAt` string, date-time: When the profile token last authorized a request
    - `createdAt` string, date-time, required: When the webhook was created
    - `updatedAt` string, date-time, required: When the webhook was last modified
    - `createdBy` string: User ID who created the webhook
    - `lastUsedAt` string, date-time: When the webhook was last triggered
    - `public` WebhookPublicSettings: What the webhook's public URL accepts
      - `sender` 'github' | 'stripe' | 'slack' | 'standard': A service whose signed requests a public URL accepts
      - `secretConfigured` boolean, required: Whether the sender's signing secret is stored
      - `events` string[], required: Events that start runs; empty takes every event
      - `createdAt` string, date-time, required: When the public URL was turned on
  - `token` string, required: Full webhook token (only shown once, store securely!)

## Other responses

- `400`: Invalid name, unavailable runtime profile, unsupported auth mode, or token limit reached
- `403`: Insufficient permissions
- `404`: No webhook or runtime profile found
- `default`: Unexpected error

## Changes

> 208 revisions in range; 1 not diffed.

- **2026-10-14** (v1) `4cf3e5ea421d`: 1 info
  - added the optional property `webhook/public` to the response with the `201` status
- **2026-10-01** (v1) `b1f5f91115ee`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/dagucloud/apis/dagu/changes/dags/:fileName/webhook/profile-tokens/post.md)

---

[API](https://skmtc.dev/dagucloud/apis/dagu.md) - [All operations](https://skmtc.dev/dagucloud/apis/dagu/llms.txt) - [OpenAPI document](https://skmtc.dev/dagucloud/apis/dagu/revisions/742c8ecb39ce?raw)