---
title: "Create webhook endpoint"
method: POST
path: "/webhooks/endpoints"
tags: ["Webhooks"]
---

# Create webhook endpoint

`POST /webhooks/endpoints`

## Request

- Base URL: `https://platform-api.homejourney.sg/v1`
- URL: `https://platform-api.homejourney.sg/v1/webhooks/endpoints`
- Auth: HTTP bearer

Creates one webhook endpoint registration for the authenticated integration client. External URL: `/v1/webhooks/endpoints`. Current Next.js implementation path: `/api/platform/v1/webhooks/endpoints`. This mutating route requires `Idempotency-Key`, SSRF-validates and normalizes the endpoint URL before storage, returns the raw `whsec_...` signing secret only in the first successful create response, persists only a redacted idempotency replay body with `signing_secret: null`, and does not perform direct delivery or AWS dispatch work.

## Headers

- `X-Correlation-Id` string
- `Idempotency-Key` string, required

## Request body

- CreatePlatformWebhookEndpointRequest: Webhook endpoint registration request. The returned signing secret is generated server-side and is never accepted from clients.
  - `url` string, uri, required: HTTPS webhook endpoint URL. The API normalizes safe URLs, rejects credentials, non-standard ports, and private DNS/IP targets, and never performs direct delivery during create.
  - `description` string
  - `subscribed_events` PlatformWebhookEventType[], required

## Response `201`

Webhook endpoint registered. The signing secret is shown once; idempotency replays return a redacted secret field.

- CreatePlatformWebhookEndpointResponse
  - `endpoint` PlatformWebhookEndpoint, required
    - `id` string, uuid, required
    - `organization_id` string, uuid, required
    - `client_id` string, uuid, required
    - `environment` 'sandbox' | 'live', required
    - `url` string, uri, required
    - `description` string, nullable, required
    - `subscribed_events` PlatformWebhookEventType[], required
    - `signing_secret_prefix` string, nullable, required: Redacted signing-secret prefix for operator matching. The digest and raw secret are never returned.
    - `status` 'active' | 'disabled' | 'revoked', required
    - `last_delivery_at` string, date-time, nullable, required
    - `failure_count` integer, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `signing_secret` string, nullable, required: Raw whsec value shown only in the first successful create response. Idempotency replays return null so raw signing secrets are not persisted.
  - `signing_secret_revealed` boolean, required
  - `livemode` boolean, required
  - `request_id` string, required

## Other responses

- `400`: Request validation failed.
- `401`: Missing or invalid platform API key.
- `403`: Credential, environment, or scope is not allowed.
- `404`: Platform API feature or resource is not available.
- `409`: Idempotency key is in progress or conflicts with an earlier request body.
- `429`: Rate limit exceeded.
- `500`: Unexpected platform API failure.

---

[API](https://skmtc.dev/homejourney/apis/homejourney-platform-api.md) · [All operations](https://skmtc.dev/homejourney/apis/homejourney-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/homejourney/apis/homejourney-platform-api/revisions/a2c6fe063db1?raw)