---
title: "Create a webhook endpoint"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /webhooks`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `webhooks:write`)

Creates an endpoint that receives the events you choose, signed with Hypamoon-Signature. The secret is in this response only. At most 10 endpoints per project.

## Request body

- WebhookEndpointInput: A new webhook endpoint.
  - `url` string, required: An https URL with a domain name on the default port, without credentials, that resolves to a public address.
  - `events` string[], required: The events to receive, from call.completed, call.summary.ready, message.delivered, message.failed, conversation.summary.ready, balance.low, balance.topped_up, balance.reload_failed, document.created, email.sent, email.delivered, email.delayed, email.bounced, email.complained. The email events come once per recipient.
  - `app_id` string, uuid: Optional, for email events only: receive only the email events of emails this app sent (an id from list_apps). Without it, the endpoint gets the events of every email of the project.

## Response `201`

The endpoint, with its secret.

- WebhookEndpointCreated: The new webhook endpoint, with its secret.
  - `id` string, uuid, required
  - `url` string, required
  - `events` string[], required: The subscribed events, from call.completed, call.summary.ready, message.delivered, message.failed, conversation.summary.ready, balance.low, balance.topped_up, balance.reload_failed, document.created.
  - `active` boolean, required: false after 50 failed deliveries in a row; switch it back on with POST /webhooks/{id}/enable.
  - `secret_prefix` string, required: The first characters of the secret, to recognize it.
  - `created_at` string, date-time, required: When the endpoint was created.
  - `last_success_at` string, date-time, nullable, required: The last delivery that got a 2xx.
  - `last_failure_at` string, date-time, nullable, required: The last delivery that failed.
  - `consecutive_failures` integer, required: Failed deliveries in a row.
  - `app_id` string, uuid: Only with a filter on one app: the endpoint gets the email events of that app's emails only.
  - `secret` string, required: The signing secret, whsec_ plus 43 characters. Shown only in this response: store it now.

## Other responses

- `400`: Bad Request: invalid_json, invalid_webhook_endpoint.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `409`: Conflict: webhook_limit_reached.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)