---
title: "Create a deploy hook: POST its url (returned once) to deploy the given branch"
method: POST
path: "/projects/{projectId}/hooks"
tags: ["Automation"]
---

# Create a deploy hook: POST its url (returned once) to deploy the given branch

`POST /projects/{projectId}/hooks`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/projects/{projectId}/hooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

Without `branch` (or with the production branch) the hook follows the production branch and redeploys production. Any other branch is deployed as that branch's preview (docs/PREVIEWS.md): the first call creates it within the preview limits, later calls redeploy it. A call to the url (POST /hooks/deploy/{hookId}/{secret}, no auth) answers {ok, target, branch, deploymentId, previewId?, previewUrl?}, or the preview error (402 limit_reached, 429 rate_limited, 501 not_configured) when the preview cannot be created.

## Path parameters

- `projectId` string, uuid, required

## Request body

- object
  - `name` string, required
  - `branch` string: Default: the production branch (the hook follows it). Any other branch is deployed as that branch's preview (Git-backed or managed projects only; needs deployments:create as well)

## Response `201`

Created (url shown once)

- object
  - `id` string, uuid, required
  - `name` string, required
  - `branch` string, nullable, required: null = the project's production branch (the hook follows it when it changes); otherwise the branch this hook deploys
  - `target` 'production' | 'preview', required: What a call does now: "production" redeploys the production branch; "preview" creates or updates the preview of `branch` (a separate environment at <branch>--<project>.<app domain>, preview limits apply). Decided at call time: a hook whose branch has since become the production branch deploys production.
  - `lastTriggeredAt` string, nullable, required: ISO-8601 timestamp
  - `createdAt` string, required: ISO-8601 timestamp
  - `url` string, required: POST this URL to trigger a deployment. Shown once: it contains the secret and cannot be shown again — create a new hook if you lose it.

## Other responses

- `400`: Invalid request (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After
- `503`: Hosting engine unavailable (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)