---
title: "Create a webhook endpoint"
method: POST
path: "/webhook_endpoints"
tags: ["webhooks"]
---

# Create a webhook endpoint

`POST /webhook_endpoints`

## Request

- Base URL: `https://api.mobilevalidate.com/v1`
- URL: `https://api.mobilevalidate.com/v1/webhook_endpoints`
- Auth: HTTP bearer

Registers a public HTTPS URL (at most 20 per account). The response contains the signing `secret` — shown only once. The endpoint stays `pending_verification` until it answers our signed `webhook.verification` event with a 2xx status. Not available with the public sandbox key.

## Request body

- object
  - `url` string, uri, required
  - `events` WebhookEvent[], required

## Response `201`

Endpoint created; `secret` is shown only this once.

- object
  - `object` 'webhook_endpoint', required
  - `id` string, required
  - `url` string, uri, required
  - `events` WebhookEvent[], required
  - `status` 'pending_verification' | 'active' | 'disabled', required
  - `livemode` boolean: Mode of the key that created the endpoint. Test keys see and manage only test endpoints, live keys only live endpoints; test-mode events are delivered only to test endpoints and live events only to live endpoints.
  - `created_at` string, date-time, required
  - `secret` string, required: Signing secret: the base64 part after whsec_ is the HMAC key.

## Other responses

- `default`: Error. Branch on `error.code`; `suggestion` (optional) says how to fix the request. A known path called with the wrong method answers `404 not_found` with an `Allow` header listing the methods it accepts.

---

[API](https://skmtc.dev/mobilevalidate/apis/mobilevalidate-api.md) · [All operations](https://skmtc.dev/mobilevalidate/apis/mobilevalidate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mobilevalidate/apis/mobilevalidate-api/revisions/f2e56c2454ef?raw)