--- title: "Register a webhook endpoint" method: POST path: "/v1/webhook-endpoints" tags: ["Webhook Endpoints"] --- # Register a webhook endpoint `POST /v1/webhook-endpoints` ## Request - Base URL: `https://api.subscriby.net` - URL: `https://api.subscriby.net/v1/webhook-endpoints` - Auth: HTTP bearer ```bash curl -X POST https://api.subscriby.net/v1/webhook-endpoints \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ -d '{ "name": "Zapier trigger", "url": "https://hooks.zapier.com/hooks/catch/...", "events": ["subscription.created", "payment.succeeded"] }' ``` Answers `201` with the endpoint and, at the top level beside `data`, the plaintext signing `secret`. > **The secret appears once.** The plaintext `secret` (prefixed `whsec_`) appears at the top level of the response **only** here and on rotate-secret. Subsequent reads never surface it; copy it into your consumer's secret storage immediately. ## Headers - `Idempotency-Key` string, uuid, required ## Request body - StoreWebhookEndpointRequest: A webhook endpoint to register: where to post, which events, and how to confine it. The signing secret is minted by Subscriby and returned once beside the endpoint. - `name` string, required: A label for the endpoint, 3 to 100 characters. - `url` string, uri, required: The target, `https://` only, up to 2,048 characters, pointing at a public host: loopback, private, link-local and reserved addresses are refused, as is a public hostname that resolves to one. - `project_id` string, uuid, nullable: Confine the endpoint to one project's events; omit it for a team-wide subscription. - `events` string[], required: The events to subscribe to, at least one. - `allowed_ips` string[], nullable: IPv4/IPv6 addresses or CIDR ranges the target must resolve to. Enforced on every delivery: when the endpoint's host resolves to an address outside the list, the delivery is dead-lettered without being posted. - `is_active` boolean: Whether deliveries flow from the start. Defaults to true. ## Response `201` 201 with the resource and a top-level `secret`. - object - `data` WebhookEndpointResource, required: A webhook endpoint: a target Subscriby posts events to, with its subscriptions and delivery health. The signing secret never appears here. - `id` string, required: The endpoint's id. - `name` string, required: The label the endpoint was registered with, 3 to 100 characters. - `url` string, required: The `https://` URL events are posted to. - `project_id` string, nullable, required: The project the endpoint is confined to; null for a team-wide endpoint that receives every project's events. - `events` string[], required: The event names the endpoint is subscribed to. - `is_active` boolean, required: Whether deliveries flow. False while paused by the creator or switched off by the worker after too many consecutive failures. - `disabled_at` string, nullable, required: When the endpoint was paused or auto-disabled, ISO 8601; null while active. - `allowed_ips` unknown[], nullable, required: IPv4/IPv6 addresses or CIDR ranges the target must resolve to; a delivery whose host resolves elsewhere is dead-lettered without being posted. Null when unrestricted. - unknown - `failure_count` integer, required: How many deliveries have failed over the endpoint's lifetime. - `consecutive_failures` integer, required: The current failure streak; the worker disables the endpoint when it reaches the limit, and resuming resets it. - `last_success_at` string, nullable, required: When a delivery last got a 2xx, ISO 8601; null until one has. - `last_failure_at` string, nullable, required: When a delivery last failed, ISO 8601; null until one has. - `created_at` string, nullable, required: When the endpoint was registered, ISO 8601. - `updated_at` string, nullable, required: When the endpoint last changed, ISO 8601. - `secret` string, required: The plaintext signing secret, `whsec_…`, returned once. Verify every delivery's `SB-Signature` with it. ## Other responses - `400`: `IDEMPOTENCY_KEY_MISSING`: every write needs an `Idempotency-Key` header. Send a fresh UUID per distinct operation. - `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production). - `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description. - `404`: `TENANT_MISMATCH`: with `reason: missing_team_scope` when the token carries no team scope. - `409`: `IDEMPOTENCY_KEY_REUSED`: the key was already used in the last 24 hours with a different request body. - `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`. On this endpoint: `VALIDATION_FAILED`: when `url` is not `https://`, points at a private or reserved host, or exceeds 2,048 characters; when `events` is empty or names an unknown event; when `allowed_ips` holds an invalid address or range; when `name` is outside 3 to 100 characters. - `425`: `IDEMPOTENCY_REPLAY_IN_PROGRESS`: the first request with this key is still running; retry in a few seconds and the original response is replayed. - `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted. --- [API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)