---
title: "Create an event destination"
method: POST
path: "/event-destinations"
tags: ["Events"]
---

# Create an event destination

`POST /event-destinations`

Registers an event destination bound to the token's account. List every subscribable event type the URL should receive on `event_types`; one destination can carry as many as you like, so a URL needs only one signing secret and your handler branches on the envelope's `type`. Register a second destination to deliver to a different URL, not to separate one event type from another. The secret is returned once, in this response. The target is validated as an https URL and screened by the delivery-time SSRF guard before it is stored. The `api_version` is pinned from the resolved `Ekho-Version`, and the creation channel is inferred from the User-Agent (Zapier clients record `zapier`, everything else `api`).

## Request body

- EventDestinationCreate
  - `url` string, uri, required — The https target URL that receives event deliveries.
  - `event_types` string[], required — Every event type this destination receives. One destination can carry as many types as you like, so a single URL needs only one signing secret. Read the envelope's `type` field to tell deliveries apart. Duplicates are collapsed.
  - `display_name` string — Optional human-friendly label for the destination.
  - `description` string — Optional longer description of the destination.

## Response `201`

The event destination was created.

- object
  - `data` EventDestination, required
    - `id` string, required — Typed event destination id; ids carry the `whe_` prefix.
    - `url` string, required
    - `event_types` string[], required — Every event type this destination receives.
    - `status` 'enabled' | 'disabled' | 'auto_disabled', required
    - `display_name` string, nullable, required
    - `description` string, nullable, required
    - `environment` 'dev' | 'test' | 'demo' | 'live', required — Token environment the destination was created under.
    - `api_version` string, required — API version pinned at creation.
    - `secret` string, nullable, required — The signing secret, returned only by create and rotate-secret. Store it on receipt; it is never shown again.
    - `created_at` integer, required — Epoch milliseconds the destination was created.

## Other responses

- `400` — The request was malformed or failed validation.
- `401` — Authentication is missing or invalid.
- `403` — The token lacks a required scope.
- `429` — The rate limit has been exceeded.
- `500` — An unexpected error occurred.

---

[API](https://skmtc.dev/ekho/apis/ekho-api.md) · [All operations](https://skmtc.dev/ekho/apis/ekho-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ekho/ekho-api/revisions/2056332cf6b9/schema)