---
title: "Create a webhook subscription"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create a webhook subscription

`POST /webhooks`

## Request

- Base URL: `https://joinways.app/api/v1`
- URL: `https://joinways.app/api/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://joinways.app/oauth/authorize`, token URL `https://joinways.app/api/oauth/token`, scopes: `mcp.write`)

Subscribes a public https endpoint to events (Zapier REST Hooks contract). The `secret` (`whsec_…`) is returned only here: keep it to check the signatures. Delivery format, headers, signature and retries are described in the **Webhooks** section above. At most 25 active subscriptions per workspace. **Role permission:** `integrations.manage`.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `target_url` string, uri, required: Public https endpoint that receives the deliveries.
  - `event_types` WebhookEventType[], required
  - `source` 'zapier' | 'custom'

## Response `201`

Subscription created. `secret` is only returned here.

- object: An outbound webhook subscription (Zapier or custom endpoint).
  - `id` string, uuid
  - `target_url` string: The endpoint; only its origin (`https://host/…`) without `integrations.manage`.
  - `event_types` WebhookEventType[]
  - `source` 'zapier' | 'custom'
  - `disabled_at` string, date-time, nullable: Set after 10 failed deliveries in a row.
  - `disabled_reason` string, nullable
  - `last_delivery_at` string, date-time, nullable
  - `created_at` string, date-time
  - `secret` string, required

## Other responses

- `400`: Validation failed (`invalid_request`). For a body that fails the schema, `details` holds `formErrors` and `fieldErrors`.
- `401`: Missing, invalid, expired or revoked bearer token (`unauthorized`).
- `403`: `forbidden`: the token lacks the scope, its owner's role lacks the permission named by the operation, or the workspace has neither the Pro plan nor a trial (`details.reason` `plan_not_eligible`).
- `422`: Active subscription quota reached (`quota_exceeded`, 25 per workspace).
- `429`: Too many requests (`rate_limited`). `details.reason`: `per-ip`, `per-account-minute`, `per-account-day`, or `email_rate_limited` (email budget). Always carries `Retry-After`: wait that many seconds.

---

[API](https://skmtc.dev/joinways/apis/joinways-public-api.md) · [All operations](https://skmtc.dev/joinways/apis/joinways-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/joinways/apis/joinways-public-api/revisions/39e84309953e?raw)