---
title: "Subscribe to an event"
method: POST
path: "/api/v1/webhooks"
tags: ["Webhooks (v1, deprecated)"]
deprecated: true
---

# Subscribe to an event

`POST /api/v1/webhooks`

## Request

- Base URL: `https://app.formaportal.com`
- URL: `https://app.formaportal.com/api/v1/webhooks`
- Auth: OAuth 2 (authorization code, authorization URL `https://app.formaportal.com/oauth/authorize`, token URL `https://app.formaportal.com/api/oauth/token`, scopes: `webhooks:write`)

> **Deprecated.**

Registers a URL to receive an event. Re-subscribing the same URL for the same
event is idempotent and returns the existing subscription.

The target must be a public HTTPS URL. Anything resolving to a loopback,
private, link-local or carrier-NAT address is rejected, credentials in the URL
are rejected, and redirects are never followed.

## Request body

- object
  - `event` 'form_submission' | 'contact_registered', required
  - `hookUrl` string, uri, required: Where to POST the event. `target_url` and `targetUrl` are accepted as aliases.

## Response `201`

Subscribed.

- WebhookSubscription
  - `id` string, required
  - `portalId` string: The portal this subscription listens to. Absent on v1, which had only one.
  - `event` 'form_submission' | 'contact_registered', required
  - `targetUrl` string, uri, required

## Other responses

- `400`: Unknown event, or a target URL that is not a public HTTPS address.
- `401`: Missing, invalid, expired or revoked token. The `WWW-Authenticate` header points at the protected-resource metadata.
- `403`: The token is valid but lacks a required scope. `WWW-Authenticate` names the scopes needed.

---

[API](https://skmtc.dev/formaportal/apis/formaportal-api.md) · [All operations](https://skmtc.dev/formaportal/apis/formaportal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/formaportal/apis/formaportal-api/revisions/a9412c3b13cb?raw)