---
title: "Register a webhook"
method: POST
path: "/api/v2/webhooks"
tags: ["Webhooks"]
---

# Register a webhook

`POST /api/v2/webhooks`

Register a webhook URL to receive event notifications. The response includes a `signing_secret` (whsec_…) that is returned **only once** — store it securely. All subsequent deliveries are signed with this secret via HMAC-SHA256.

## Headers

- `X-API-KEY` string, nullable
- `Authorization` string, nullable
- `X-Workspace-Id` string, nullable

## Request body

- CreateWebhookRequest — Request body for creating a webhook.
  - `posting_id` string, required — ID of the posting this webhook is for.
  - `webhook_url` string, required — Destination URL for webhook delivery.
  - `event_type` string, required — Type of event that triggers the webhook. Supported values: 'interview_started', 'interview_completed', 'report_available', 'candidate_shortlisted', 'candidate_rejected'.

## Response `201`

Successful Response

- SingleResponseWebhookWithSecretResponse
  - `data` WebhookWithSecretResponse, required — Webhook response returned only at creation time, includes the signing secret.
    - `object` 'webhook' — Object type identifier.
    - `webhook_id` string, required — Unique webhook identifier.
    - `posting_id` string, required — ID of the posting this webhook is for.
    - `webhook_url` string, required — Destination URL for the webhook.
    - `event_type` string, required — Type of event that triggers the webhook.
    - `is_active` boolean, required — Whether the webhook is active.
    - `created_at` number, required — Unix timestamp when the webhook was created.
    - `updated_at` number, required — Unix timestamp when the webhook was last updated.
    - `signing_secret` string, required — HMAC-SHA256 signing secret (whsec_…). This value is returned only once in the create response; it is never included in list or get responses. Store it securely — it cannot be retrieved again.
  - `meta` object, nullable — Optional metadata. Shape varies by endpoint.

## Other responses

- `401` — Invalid or missing API key.
- `404` — Resource not found.
- `422` — Validation Error
- `429` — Rate limit exceeded.

---

[API](https://skmtc.dev/heymilo/apis/heymilo-public-api.md) · [All operations](https://skmtc.dev/heymilo/apis/heymilo-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/heymilo/heymilo-public-api/revisions/45baf1f1338c/schema)