---
title: "Create a webhook endpoint"
method: POST
path: "/v1/webhooks"
tags: ["webhooks"]
---

# Create a webhook endpoint

`POST /v1/webhooks`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Registers an `active` webhook endpoint that receives the event types in `events` as signed HTTPS `POST` requests. See the [webhooks guide](/docs/guides/webhooks) for delivery, signing, and retry behavior.

The `201` response is the only response that includes the signing secret (`whsec_` prefix). Store it immediately; if it is lost, [rotate the signing secret](/docs/api/reference/rotate-webhook-secret).

A non-HTTPS or non-public `url`, an unknown event type, or exceeding the organization's endpoint limit returns `422`.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Request body

- WebhookEndpointCreate
  - `url` string, uri: HTTPS URL to deliver events to, at most 2048 characters. The host must be publicly reachable: URLs on private, loopback, or link-local addresses are rejected with a `422`. Required unless `destination` is a connector, whose URL comes from the connector and its `config`; a URL given with one must equal it.
  - `filter` WebhookFilter: Exact match on `mailbox_id`, for `email_mailbox.*` events only; the mailbox must belong to this workspace. Cannot be combined with Realtime app scope. Omit on create for all resources; on update omit to keep, send `null` to clear.
    - `mailbox_id` string, required
  - `events` WebhookEventType[], required: Event types to subscribe to; the endpoint receives only matching events. Types outside the event catalog return a `422`, and an endpoint holds at most 100 entries.
  - `description` string: Human-readable label for this endpoint, up to 256 characters.
  - `destination` union: How each delivery to the endpoint is built. The type cannot change after the endpoint is created.
    - WebhookRawDestination: Posts the signed event to the endpoint's `url` unchanged.
      - `type` 'webhook', required
    - WebhookConnectorDestinationCreate: Sends the request a connector action builds, with credentials stored for this endpoint.
      - `type` 'connector', required
      - `connector` WebhookConnectorSetup, required: The connector to deliver through and the values it needs. Omit the endpoint's `url`: Bird builds it from the connector's URL and these `config` values, and a URL given anyway must equal that. The credentials belong to this endpoint alone, and deleting the endpoint erases them.
        - `connector_id` string, required: The connector to deliver through. Each connector, its fields and the setup to do on its platform first: - `claude_managed_agents`: Claude Managed Agents. Send each message you receive to your Claude managed agent. - `agent_id` (`config`, required): Returned when you create the agent. Sessions use its latest version. - `environment_id` (`config`, required): Returned when you create the environment. - `vault_id` (`config`, optional): A credential vault the agent uses, such as the one holding its Bird MCP credential, so it can reply through Bird. - `api_key` (secret, in `credentials`, required): From the Claude workspace your agent runs in. - Events: `whatsapp.received`, `sms.received`, `email_mailbox.message_received`, `amb.received`. - Setup 1: First, set up your agent in Claude. In the Claude Console, create the agent, its environment and an API key in the same workspace, then come back here with their IDs and the key. See https://platform.claude.com/docs/en/managed-agents/quickstart#create-your-first-session. - Setup 2: Create an API key. In the Claude workspace your agent runs in. See https://platform.claude.com/settings/keys. - Setup 3: Copy the agent and environment IDs. Each create returns its ID. See https://platform.claude.com/docs/en/managed-agents/quickstart#create-your-first-session. - Setup 4: Optionally, add a credential vault. To let the agent reply through Bird, store its Bird MCP credential in a Claude credential vault and give the vault ID here. Each session gets that vault. See https://platform.claude.com/docs/en/managed-agents/vaults. - `grok_bot`: Grok Bot. Send each message you receive to a Grok Bot routine. - `webhook_url` (`config`, required): The routine's webhook URL. - `sender_key` (secret, in `credentials`, required): The routine's sender key. Bird sends it only as the Bearer token. - Events: `whatsapp.received`, `sms.received`, `email_mailbox.message_received`, `amb.received`. - Setup 1: First, ask Grok Bot to create a routine. Ask Grok Bot to create a routine with a webhook trigger, then paste the webhook URL and sender key it gives you below. See https://cursor.com/docs/cloud-agent/automations#webhook-triggers.
        - `action` string: Identifier of an action, unique within its connector.
        - `credentials` ConnectionCredentials, required: Values for the connector's secret fields, keyed by field `name`. Every required secret field must be present, after merging with the stored values on an update, and a key the connector does not declare as secret returns a `422`. No response includes these values.
        - `config` ConnectionConfig: Values for the connector's nonsecret fields, keyed by field `name`, such as the URL the endpoint's requests go to. A URL must be HTTPS, on one of the connector's `allowed_origins`, and under its `path_prefix` when it has one. It cannot include user info, a fragment, an IP address as its host, dot segments, or encoded slashes.

## Response `201`

Created webhook endpoint, including its one-time signing secret.

- WebhookEndpointCreated
  - `id` string, required
  - `url` string, uri, required: HTTPS URL where the API delivers events for this endpoint.
  - `description` string: Human-readable label for the endpoint.
  - `filter` WebhookFilter, required: Exact match on `mailbox_id`, for `email_mailbox.*` events only; the mailbox must belong to this workspace. Cannot be combined with Realtime app scope. Omit on create for all resources; on update omit to keep, send `null` to clear.
    - `mailbox_id` string, required
  - `events` WebhookEventType[], required: Event types this endpoint is subscribed to; only matching events are delivered. Change the set with [Update a webhook endpoint](/docs/api/reference/update-webhook).
  - `status` 'active' | 'degraded' | 'paused', required: Delivery state of the endpoint. - `active`: The initial state; events are being delivered normally. - `degraded`: Recent deliveries are failing. We keep delivering and retrying, and the endpoint returns to `active` automatically once deliveries succeed again. - `paused`: All delivery is stopped, either because an update set `status` to `paused` or automatically after sustained delivery failures. A paused endpoint never resumes on its own: re-enable it with [Update a webhook endpoint](/docs/api/reference/update-webhook), then [Replay failed deliveries](/docs/api/reference/create-webhook-replay) to recover the deliveries that failed before the pause. Events that arrived while it was paused were never attempted, so a replay does not reach them.
  - `destination` union: How each delivery to the endpoint is built. The type cannot change after the endpoint is created.
    - WebhookRawDestination: Posts the signed event to the endpoint's `url` unchanged.
      - `type` 'webhook', required
    - WebhookConnectorDestination: Sends the request a connector action builds, with the credentials stored for this endpoint. The endpoint's URL comes from its connector setup, so updating the endpoint with a `url` returns a `422`.
      - `type` 'connector', required
      - `connector` WebhookConnectorBinding, required
        - `connector_id` string, required: Stable identifier of a connector, such as `claude_managed_agents`.
        - `action` string, required: Identifier of an action, unique within its connector.
        - `connection_name` string, required: Label of the credentials the endpoint delivers with.
        - `config` ConnectionConfig: Values for the connector's nonsecret fields, keyed by field `name`, such as the URL the endpoint's requests go to. A URL must be HTTPS, on one of the connector's `allowed_origins`, and under its `path_prefix` when it has one. It cannot include user info, a fragment, an IP address as its host, dot segments, or encoded slashes.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `secret` string, required: Signing secret for this endpoint (`whsec_` prefix), used to verify every delivery signature. Present in this response only: store it immediately, it cannot be retrieved again. If you lose it, mint a new one with [Rotate webhook signing secret](/docs/api/reference/rotate-webhook-secret).
  - `next` NextAction[]: What to do next with this endpoint. Empty: deliveries start as the events happen, with nothing left to set up.
    - `kind` string, required: What you do about this step. - `operation`: call the operation named in `operation`, then read again. - `external`: act somewhere this API does not reach, then read again. - `wait`: nothing is asked of you, so read again later. - `terminal`: nothing you do resolves this, so stop retrying. Tolerate a value you do not recognize: show the `description` and offer no action.
    - `description` string, required: A short, human-readable label for the step, suitable for display.
    - `operation` string: The operationId to call. Present only when `kind` is `operation`. The operation's own schema says how to call it; this says only which one, and what to address it with.
    - `params` object: The parameters that address the operation, by name: `{"sender_id": "…"}` for an operation on `/v1/sms/senders/{sender_id}/requirements`. A parameter the operation takes in its query string is given the same way, so an operation addressed as `?subject_id=` carries `{"subject_id": "…"}`. Every parameter the call needs is here, whether its value came from the thing you were acting on or is fixed for this step, so you can make the call from this object alone. Present only when `kind` is `operation` and the operation names a subject. A request body, when the operation takes one, is described by the operation's own schema and never appears here.
    - `url` string, uri: A URL to open. Present only when `kind` is `external`, and only when the step has one. An external step whose `description` says to go and do something with no URL to open is normal.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)