---
title: "Create a new webhook configuration."
method: POST
path: "/api/v1/webhooks/"
tags: ["Webhook Configuration"]
---

# Create a new webhook configuration.

`POST /api/v1/webhooks/`

## Request

- Base URL: `https://partnerapi-staging.depop.com`
- URL: `https://partnerapi-staging.depop.com/api/v1/webhooks/`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/depop/apis/seller-api/docs/api/v1/webhooks/post.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint allows you to create a new webhook configuration.
A maximum of 10 webhook configurations can be created at any time.

## Request body

- WebhookCreationRequest
  - `url` string, url, required: The publicly accessible URL where you wish to receive incoming webhooks. This must be a valid HTTPS url.
  - `enabled` boolean, required: If this webhook configuration is enabled webhooks will be sent to the configured URL. If enabled is false no webhooks will be sent.
  - `event_types` string[], required: The Depop event types you wish to receive webhooks for. Event types can either be the full name of an event, e.g. `v1:order.new`, or an event prefix with a wildcard. For example, if you wished to subscribe to all `v1` events you could supply the event type `v1:*`, or if you wished to subscribe to all order events `v1:order.*`. Supplying a wildcard will also automatically subscribe you to any new events created in future which match that scheme. Wildcards must specify an event version, and can optionally supply a resource, however this cannot be a partial resource. See below for some examples: Valid: - v1:* - v1:order.* - v1:product.* Invalid: - * - v1* - v1:ord* - v1:product.*like - v1:product.u*

## Response `200`

Webhook configuration was created successfully.

- WebhookCreationResponse
  - `webhook_id` string, uuid, required: The ID of the newly created webhook configuration.
  - `secret` string, required: The secret which can be used to verify that incoming webhooks were generated by Depop. Use this string as-is as the HMAC-SHA256 key when verifying the `X-Depop-Signature` header — do not base64-decode it. It should be kept secret and never shared with anyone. You can use this secret to verify the legitimacy of webhooks by following the guide at https://partnerapi.depop.com/api-docs/how-to-guides/validate-webhooks/.

## Other responses

- `400`: Webhook creation request was invalid.
- `401`: Unauthorized
- `403`: Forbidden - Insufficient scope
- `409`: A webhook configuration with the given URL already exists.
- `429`: Too Many Requests - the rate limit for a shop or seller, or the overall limit for your integration, has been exceeded.
- `502`: Bad Gateway - an upstream service required to build the insights response failed or returned an unexpected response.

---

[API](https://skmtc.dev/depop/apis/seller-api.md) - [All operations](https://skmtc.dev/depop/apis/seller-api/llms.txt) - [OpenAPI document](https://skmtc.dev/depop/apis/seller-api/revisions/56fef8e38e44?raw)