---
title: "Create a webhook"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /webhooks`

## Request

- Base URL: `https://api.eusend.dev`
- URL: `https://api.eusend.dev/webhooks`
- Auth: HTTP bearer

Returns the signing secret once at creation. Deliveries carry an HMAC signature header; verify it before trusting a payload.

## Request body

- CreateWebhookRequest
  - `url` string, uri, required: HTTPS endpoint. Private, loopback and link-local addresses are refused.
  - `events` string[], required: Use `*` to subscribe to every event.

## Response `201`

Created.

- CreateWebhookResponse
  - `id` string, uuid, required
  - `url` string, uri, required
  - `events` string[], required
  - `createdAt` string, date-time, required
  - `secret` string, required: Signing secret for the `X-Eusend-Signature` HMAC. Retrievable later from the secret endpoint.

## Other responses

- `400`: The request body or query failed validation (`VALIDATION_ERROR`).
- `401`: Missing, malformed, or revoked API key (`UNAUTHORIZED`).
- `403`: The plan webhook limit is reached (`PLAN_LIMIT_EXCEEDED`).
- `429`: Rate limit exceeded (`RATE_LIMITED`).
- `500`: Unexpected server error (`INTERNAL_ERROR`). Carries `request_id`.

---

[API](https://skmtc.dev/eusend/apis/eusend-api.md) · [All operations](https://skmtc.dev/eusend/apis/eusend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eusend/apis/eusend-api/revisions/bec561f55488?raw)