---
title: "Create a webhook"
method: POST
path: "/webhook"
tags: ["webhook"]
---

# Create a webhook

`POST /webhook`

## Request

- Base URL: `http://localhost:3030`
- URL: `http://localhost:3030/webhook`
- Auth: HTTP bearer

Creates a webhook that sends the events you choose to your URL.

The response includes the signing secret, `secret`, which is shown only once. Use it to verify
the `webhook-signature` header on each delivery. The URL must use `https`, be reachable from the
internet and contain no credentials.

## Request body

- WebhookBody
  - `url` string, required: The URL deliveries are sent to. Must be `https` and reachable from the internet. Redirects are not followed.
  - `name` string, nullable: A name for the webhook, up to 200 characters.
  - `event_type` string[], required: The event types delivered to this webhook.
  - `active` boolean: Whether events are delivered. While `false`, deliveries are held. Defaults to `true`.
  - `retry_policy` RetryPolicy: How a failed delivery is retried. A delivery that fails `max_attempt` times, or is still undelivered `dead_letter_after_hours` after its event, is dead-lettered.
    - `max_attempt` integer: Maximum attempts per delivery, between 1 and 20. Defaults to 12.
    - `backoff` 'exponential' | 'linear' | 'fixed': How the wait between attempts grows. One of `exponential` (doubles), `linear` (adds `base_seconds`) or `fixed`. No wait exceeds six hours. Defaults to `exponential`.
    - `base_seconds` integer: Seconds to wait after the first failed attempt, between 1 and 3600. Defaults to 60.
    - `jitter` boolean: Whether each wait is randomized to between half and all of its length. Defaults to `true`.
    - `dead_letter_after_hours` integer: Hours after the event after which retries stop, between 1 and 720. Defaults to 24.

## Response `201`

The webhook.

- CreatedWebhook
  - `object` 'webhook', required: The object's type. Always `webhook`.
  - `id` string, required: Unique identifier for the object.
  - `name` string, nullable, required: The webhook's name. Null when none was given.
  - `url` string, required: The URL deliveries are sent to.
  - `event_type` string[], required: The event types delivered to this webhook.
  - `active` boolean, required: Whether events are delivered. While `false`, deliveries are held.
  - `secret_fingerprint` string, required: A fingerprint of the signing secret, for telling secrets apart.
  - `retry_policy` RetryPolicy, required: How a failed delivery is retried. A delivery that fails `max_attempt` times, or is still undelivered `dead_letter_after_hours` after its event, is dead-lettered.
    - `max_attempt` integer: Maximum attempts per delivery, between 1 and 20. Defaults to 12.
    - `backoff` 'exponential' | 'linear' | 'fixed': How the wait between attempts grows. One of `exponential` (doubles), `linear` (adds `base_seconds`) or `fixed`. No wait exceeds six hours. Defaults to `exponential`.
    - `base_seconds` integer: Seconds to wait after the first failed attempt, between 1 and 3600. Defaults to 60.
    - `jitter` boolean: Whether each wait is randomized to between half and all of its length. Defaults to `true`.
    - `dead_letter_after_hours` integer: Hours after the event after which retries stop, between 1 and 720. Defaults to 24.
  - `created_at` string, date-time, required: Time at which the object was created.
  - `updated_at` string, date-time, required: Time at which the object was last updated.
  - `href` string, required: The path of this webhook.
  - `secret` string, required: The signing secret, `whsec_...`. Returned only when the webhook is created.

## Other responses

- `401`: `credential_missing`, `credential_invalid` or `credential_expired`. The request has no valid credential.
- `403`: `scope_missing`, `person_required`, `api_key_not_accepted` or `entitlement_missing`. The credential or plan does not allow this request. `detail` names the reason.
- `422`: `parameter_invalid`, `id_malformed` or a cursor code. A parameter is missing or invalid. `errors` lists each one.
- `429`: `rate_limited`. Too many requests. Retry after the `Retry-After` interval. Nothing is charged.

---

[API](https://skmtc.dev/placestack/apis/placestack-api.md) · [All operations](https://skmtc.dev/placestack/apis/placestack-api/llms.txt) · [OpenAPI document](https://skmtc.dev/placestack/apis/placestack-api/revisions/0ccdf0882668?raw)