---
title: "Create a webhook endpoint"
method: POST
path: "/v1/webhook-endpoints"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /v1/webhook-endpoints`

## Request

- Base URL: `https://hyperscale0.ai`
- URL: `https://hyperscale0.ai/v1/webhook-endpoints`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Registers an outbound webhook endpoint for one Product's audit-event delivery and returns the signing secret exactly once in the create response. Sandbox accepts http URLs and live endpoints must use HTTPS. Both refuse loopback and private hosts.

Needs a Product key made in the browser. A key made from a CLI login or an agent token cannot call this operation.

## Headers

- `X-Hyperscale-Environment` 'sandbox' | 'live'
- `Idempotency-Key` string, required

## Request body

- object
  - `url` string, required
  - `enabledEvents` union[], required
    - union
      - '*'
      - string: Hyperscale audit event type emitted from an operation policy
  - `description` string
  - `productId` string, required: Product whose attributed events this endpoint receives.
  - `entityAccountId` string: Deliver only events naming this account, to a channel for the end customer who owns it. Omit for the Product's own webhook.

## Response `201`

Success

- WebhookEndpointCreateOutput
  - `tenantId` string, required: Organization tenant ID
  - `webhookEndpointId` string, required: Hyperscale outbound webhook endpoint ID
  - `productId` string, required: Hyperscale product ID
  - `url` string, required
  - `status` 'deleted' | 'disabled' | 'enabled', required
  - `audience` 'entity' | 'tenant', required
  - `entityAccountId` string, nullable, required: Hyperscale account ID
  - `enabledEvents` union[], required
    - union
      - '*'
      - string: Hyperscale audit event type emitted from an operation policy
  - `secretLast4` string, required
  - `description` string, nullable, required
  - `lastDeliveryStatus` 'exhausted' | 'failed' | 'pending' | 'succeeded', nullable, required
  - `lastDeliveryAt` string, date-time, nullable, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `signingSecret` string: One-time signing secret surfaced only in the first response; receipts and replays omit it

## Other responses

- `default`: ErrorResponse. See x-error-codes and x-errors for codes, HTTP statuses and retry guidance.

---

[API](https://skmtc.dev/hyperscale0/apis/hyperscale-product-api.md) · [All operations](https://skmtc.dev/hyperscale0/apis/hyperscale-product-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hyperscale0/apis/hyperscale-product-api/revisions/e9e8faa044d5?raw)