---
title: "Create site webhook"
method: POST
path: "/api/sites/{id}/webhooks"
tags: ["Webhooks"]
---

# Create site webhook

`POST /api/sites/{id}/webhooks`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/sites/{id}/webhooks`
- Auth: API key in cookie `hk_token`

Creates a webhook and returns its signing secret exactly once. Human dashboard session only.

## Path parameters

- `id` string, uuid, required

## Request body

- WebhookInput
  - `description` string
  - `enabled` boolean, required
  - `events` string[], required
  - `name` string, required
  - `url` string, uri, required: HTTPS destination. Loopback, private, link-local, multicast, and otherwise unsafe addresses are rejected unless development targets are explicitly enabled.

## Response `201`

Created webhook and one-time secret

- WebhookSecretResponse
  - `secret` string, required: One-time signing secret. It is returned only on creation or rotation.
  - `webhook` Webhook, required
    - `created_at` string, date-time, required
    - `description` string, required
    - `enabled` boolean, required
    - `events` string[], required
    - `id` string, uuid, required
    - `name` string, required
    - `scope` 'instance' | 'site', required
    - `site_id` string, uuid, nullable
    - `updated_at` string, date-time, required
    - `url` string, uri, required

## Other responses

- `400`: Invalid event or destination

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)