---
title: "Register a webhook endpoint"
method: POST
path: "/v1/me/webhooks"
tags: ["Account"]
---

# Register a webhook endpoint

`POST /v1/me/webhooks`

## Request

- Base URL: `https://api.gunspec.io`
- URL: `https://api.gunspec.io/v1/me/webhooks`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Registers an HTTPS endpoint to receive event deliveries. The response includes a signing secret; it is shown once and cannot be retrieved later.

Each delivery is a POST carrying `X-Webhook-Signature` (`t=<unix>,v1=<hmac-sha256 of `t.body`>`), `X-Webhook-Id` (the event, stable across retries, so dedupe on it), `X-Webhook-Event` and `X-Webhook-Delivery` (this attempt). A non-2xx response is retried three times, 1, 5 and 15 minutes apart.

Catalog events carry the record in the same shape `GET /v1/firearms/{id}` returns it, `version` included, so a cache can be updated without a second call. A deletion carries the id alone.

Requires an API key belonging to a user account. Acts on the calling account's own data.

## Request body

- object
  - `url` string, required: Where deliveries are POSTed. A public https hostname on port 443: no IP address, no credentials in the URL, and not a gunspec.io or workers.dev host. Redirects are not followed, so register the final URL. At most 2,048 characters.
  - `events` string[], required: Event types this endpoint is subscribed to. The full list is on the `POST` operation.
  - `description` string: Prose summary of the record, where one has been written.

## Response `201`

The created endpoint, including its signing secret

- object
  - `success` boolean, required: Always true on a successful response. Every error carries `false` and an `error` object instead.
  - `data` WebhookEndpointCreated, required
    - `id` string, required: Opaque endpoint id. Address it at `/v1/me/webhooks/{endpointId}`.
    - `url` string, required: Absolute, directly fetchable URL.
    - `events` string[], required: Event types this endpoint is subscribed to. The full list is on the `POST` operation.
    - `description` string, nullable: Prose summary of the record, where one has been written.
    - `active` boolean, required: False while the endpoint is paused. A paused endpoint receives nothing and is not retried.
    - `createdAt` string: When the record was first added, `YYYY-MM-DD HH:MM:SS` in UTC.
    - `updatedAt` string: When the endpoint was last changed, ISO 8601.
    - `secret` string, required: HMAC signing secret. Returned only here, on creation. No other endpoint will show it again.

## Other responses

- `400`: Validation error
- `401`: Missing or invalid API key
- `403`: The credential is valid and the caller is not permitted. Three causes, none of which reissuing a key changes: the plan is below the endpoint's tier, the account is suspended, or the key is not attached to the thing being acted on, meaning a user account for `/v1/me` or a shop for `/v1/vendor`. Distinct from 401, which means the credential is missing, malformed or expired and a new one can work.
- `413`: The request body is larger than this endpoint accepts, which is 1 MB for a JSON body. Refused from `Content-Length` before the body is read, so nothing was stored and the request can be split and resent. `error.maxBytes` carries the limit.
- `429`: A limit was reached. `RATE_LIMITED` is the per-minute limit: wait `Retry-After` seconds (a minute) and retry. `DAILY_CAP_EXCEEDED` is the plan's daily limit, per key: nothing will be served until the counters return to zero at midnight UTC. `MONTHLY_CAP_EXCEEDED` is the plan's monthly allowance, for the whole account: nothing will be served until midnight UTC on the first of next month, or until the plan changes. For both, `Retry-After` is the seconds until then and `error.resetsAt` says when as an instant. Calls made after a refusal are refused too and do not spend the month, and a free key that keeps calling is paused, so stop at the first one and resume at the reset.
- `500`: Internal server error

---

[API](https://skmtc.dev/gunspec/apis/gunspec-io-api.md) · [All operations](https://skmtc.dev/gunspec/apis/gunspec-io-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gunspec/apis/gunspec-io-api/revisions/f2e974d8b05c?raw)