---
title: "Send events to an HTTPS URL, signed with HMAC-SHA256; up to 50 per org. Returns the signing secret once. Reference: https://daybooked.io/docs/api#webhooks_create"
method: POST
path: "/webhooks"
tags: ["webhooks"]
---

# Send events to an HTTPS URL, signed with HMAC-SHA256; up to 50 per org. Returns the signing secret once. Reference: https://daybooked.io/docs/api#webhooks_create

`POST /webhooks`

## Request

- Base URL: `https://daybag.io/api/v1`
- URL: `https://daybag.io/api/v1/webhooks`
- Auth: HTTP bearer

## Request body

- object
  - `url` string, uri, required
  - `events` string[]: Event types, or ["*"] for all (default)

## Response `201`

Success

- object
  - `id` string, required
  - `url` string, required
  - `events` string[], required: Event types it receives; ["*"] means all
  - `active` boolean, required: false once its endpoint answered 410 Gone, or the API key that made it was revoked: it gets no more events and doesn't count toward the 50
  - `api_key_id` string, nullable, required: The API key that made it, whose revoking switches it off; null when no key did (the dashboard, an OAuth sign-in)
  - `last_status` integer, nullable, required: HTTP status of the last delivery; 0 = unreachable
  - `last_error` string, nullable: Why the last delivery failed, or why the webhook was switched off
  - `last_attempt_at` string, nullable, required: ISO 8601 timestamp (UTC)
  - `created_at` string, required: ISO 8601 timestamp (UTC)
  - `secret` string, required: Verifies the Daybooked-Signature header. Shown once.

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/daybag/apis/daybooked-io-api.md) · [All operations](https://skmtc.dev/daybag/apis/daybooked-io-api/llms.txt) · [OpenAPI document](https://skmtc.dev/daybag/apis/daybooked-io-api/revisions/1f576dead370?raw)