---
title: "Create a webhook endpoint"
method: POST
path: "/v1/webhook-endpoints"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /v1/webhook-endpoints`

## Request

- Base URL: `https://api-eu.dynamicdocumentapi.com`
- URL: `https://api-eu.dynamicdocumentapi.com/v1/webhook-endpoints`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

The response carries the signing `secret` **once** — store it now. Deliveries are signed per [Standard Webhooks](https://www.standardwebhooks.com/); see [webhooks](https://dynamicdocumentapi.com/docs/webhooks).

## Headers

- `Idempotency-Key` string

## Request body

- WebhookEndpointWrite
  - `description` string
  - `enabled` boolean
  - `events` string[], required
  - `headers` object: Extra request headers.
  - `is_default` boolean: Receive events from renders without an inline `webhook`.
  - `managed_by` 'zapier' | 'make' | 'n8n' | 'bubble' | 'pipedream' | 'activepieces' | 'power_automate': Create only. Set from the OAuth token when it belongs to an integration's app (e.g. Zapier's), which may send the same value; API keys can't set it. * `zapier` - zapier * `make` - make * `n8n` - n8n * `bubble` - bubble * `pipedream` - pipedream * `activepieces` - activepieces * `power_automate` - power_automate
  - `template_ids` string[]: Only deliver events for these templates.
  - `url` string, uri, required: Absolute https URL with a public host and no credentials, on port 443, 80, 8080 or 8443.

## Response `201`

Created; `secret` is shown once.

- WebhookEndpointWithSecret: Create and roll-secret responses: the signing secret is returned once and never again.
  - `created_at` string, date-time, required
  - `description` string, required
  - `disabled_reason` string, nullable, required: Set when Dynamic Document API disabled the endpoint after repeated failures, or because its URL answered `410 Gone`.
  - `enabled` boolean, required
  - `events` string[], required
  - `headers` object, required: Header names; the values are masked.
  - `id` string, required: `whe_…`
  - `is_default` boolean, required
  - `managed_by` 'zapier' | 'make' | 'n8n' | 'bubble' | 'pipedream' | 'activepieces' | 'power_automate' | 'null', nullable, required: The integration (e.g. `zapier`) that created the endpoint for its instant triggers; null for your own endpoints. It is never the default endpoint, the dashboard shows it read-only, and it is deleted when you disconnect the integration or when its URL answers `410 Gone`. * `zapier` - zapier * `make` - make * `n8n` - n8n * `bubble` - bubble * `pipedream` - pipedream * `activepieces` - activepieces * `power_automate` - power_automate
  - `object` string
  - `secret` string, required: `whsec_…`, base64 of 32 random bytes. Shown once.
  - `secret_rotation` WebhookSecretRotation, required
    - `previous_expires_at` string, date-time, nullable, required: When the previous secret stops being accepted.
  - `template_ids` string[], required: Empty list = every template.
  - `updated_at` string, date-time, required
  - `url` string, uri, required

## Other responses

- `400`: Invalid request body (`errors[]` with JSON pointers).
- `401`: Missing, invalid, expired or revoked credentials.
- `403`: Insufficient scope, IP not allowed, workspace suspended or scheduled for deletion, or email not verified.
- `429`: Rate limited (`Retry-After`).
- `503`: The control plane is unreachable (`Retry-After`).

## Changes

- **2026-10-19** `0f14bc0000f4`: 2 info
  - added the new optional request property `managed_by`
  - added the required property `managed_by` to the response with the `201` status

[Operation history](https://skmtc.dev/dynamicdocumentapi/apis/dynamic-document-api/changes/v1/webhook-endpoints/post.md)

---

[API](https://skmtc.dev/dynamicdocumentapi/apis/dynamic-document-api.md) · [All operations](https://skmtc.dev/dynamicdocumentapi/apis/dynamic-document-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dynamicdocumentapi/apis/dynamic-document-api/revisions/0f14bc0000f4?raw)