---
title: "Create a webhook endpoint"
method: POST
path: "/v4/webhook_endpoints"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /v4/webhook_endpoints`

## Request

- Base URL: `https://api.kit.com`
- URL: `https://api.kit.com/v4/webhook_endpoints`
- Auth: one of:
  - API key in header `X-Kit-Api-Key`
  - OAuth 2
    - Authorization code: `https://api.kit.com/v4/oauth/authorize`
    - Token URL: `https://api.kit.com/v4/oauth/token`

Registers a URL to receive deliveries for the [event types](/webhooks/event-types) listed in `events`. The `url` must be publicly reachable over HTTP(S) — private, internal, and loopback addresses are rejected.

**The response is the only time the signing `secret` is returned in plaintext.** Store it securely; you need it to [verify the signature](/webhooks/verifying-signatures) on every delivery. If you lose it, [rotate the secret](/api-reference/webhooks/rotate-a-webhook-endpoint-secret) to get a new one.

**Note:** This resource supersedes the [legacy Webhooks](/api-reference/webhooks-legacy/create-a-webhook) resource. Legacy webhooks keep working, but new integrations should be built here — see [getting started](/webhooks/getting-started) for a full walkthrough.

## Request body

- object
  - `url` string, required
  - `events` string[], required: Event types this endpoint subscribes to (e.g. `subscriber.created`). On update, the list supplied here replaces the endpoint's full subscription list.
  - `name` string
  - `description` string

## Response `201`

Creates a webhook endpoint

- object
  - `webhook_endpoint` object, required
    - `id` integer, required
    - `name` string, required
    - `url` string, required
    - `events` string[], required
    - `status` string, required
    - `source` string, required
    - `description` string, required
    - `created_by_app` unknown, required
    - `created_at` string, required
    - `previous_secret_expires_at` unknown, required
    - `secret` string, required: Signing secret used to verify webhook deliveries (`whsec_` prefix). **Returned only in this response** — store it securely; it cannot be retrieved again.

## Changes

- **2026-11-03** `f04308f83b63`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kit/apis/kit-api/changes/v4/webhook_endpoints/post.md)

---

[API](https://skmtc.dev/kit/apis/kit-api.md) - [All operations](https://skmtc.dev/kit/apis/kit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kit/apis/kit-api/revisions/f04308f83b63?raw)