--- title: "Create webhook" method: POST path: "/api/webhooks" tags: ["webhooks"] --- # Create webhook `POST /api/webhooks` ## Request - Base URL: `https://beta.getsales.io/integrations/v1` - URL: `https://beta.getsales.io/integrations/v1/api/webhooks` - Auth: HTTP bearer and API key in header `Team-SID` Subscribe an https endpoint to platform events: the server mints a 32-hex secret and returns it in this response ONLY (masked afterwards); the receiver verifies X-Webhook-Signature with it. target_url must be https on a public host, unique per team (409 duplicate_rejected); events is an exact list of catalog types (no wildcard); filters.account_sid narrows to one sending identity. Every producing service delivers through this one subscription. Contract: - MCP tool `create_webhook`, registry package `mcp.integrations/webhooks`, mount `integrations.webhooks`. - Operation `create`, response envelope `create`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API. ## Request body - CreateWebhookRequest: Request body of `create_webhook`. - `name` string, required: Free text, 1..255 chars. - `target_url` string, required: https only, a public host (no private or local address). - `events` string[], required: At least one catalog event type; exact membership. - `filters` object: Optional narrowing by sending identity. - `account_sid` string, nullable: Deliver only the events of this sending identity (18 chars, e.g. a sender profile ub_sp_...); null = no narrowing. ## Response `200` `create` success envelope. - CreateWebhookResponse - `success` true, required - `operation` 'create', required - `item` object, required - `sid` string, required: Webhook sid (wh_hk_...). - `team_sid` string, required: The subscribing workspace (ts_tm_...). - `name` string, required: Free text, 1..255 chars. - `target_url` string, required: The https endpoint events are POSTed to; one subscription per team per URL. - `events` string[], required: The subscribed event types (WebhookEventTypeEnum values), exact membership. - `filters` object, nullable, required: The narrowing by sending identity; null or {} = every subscribed event. - `account_sid` string, nullable: Deliver only the events of this sending identity (18 chars, e.g. a sender profile ub_sp_...); null = no narrowing. - `secret` string, nullable: The 32-hex HMAC secret: in the create response only, null on every other read. - `status` 'on' | 'off' | 'failed', required: on; off (switched off by hand); failed (20 failed deliveries in a row or one 410: revive with update status on). - `consecutive_failed_attempts` integer, required: Failed deliveries in a row, driven by the log; 20 trips the auto-disable. - `last_failure_at` string, nullable, required: ISO 8601 UTC of the most recent failed delivery. - `created_by` object, required: Who subscribed. - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required - `actor_sid` string, nullable, required - `team_sid` string, required - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path. - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract. - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write. - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row. - `deleted_by` object, nullable, required: Who deleted it; null while live. - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required - `actor_sid` string, nullable, required - `team_sid` string, required - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path. - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract. - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write. - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row. - `created_at` string, required: ISO 8601 UTC. - `updated_at` string, required: ISO 8601 UTC. - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live. - `already_exists` boolean, required - `meta` object, required - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header. - `span_id` string, required: 16 hex chars, root span of this request. - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. - `duration_ms` integer, required: Server-side wall clock. - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. ## Other responses - `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. - `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable. --- [API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/revisions/2e7105d58335?raw)