---
title: "Subscribe to events. The signing secret is returned ONCE in the response."
method: POST
path: "/api/v1/webhooks"
tags: ["Webhooks"]
---

# Subscribe to events. The signing secret is returned ONCE in the response.

`POST /api/v1/webhooks`

## Request

- Base URL: `https://qrlia.dev.castlesoft.eu`
- URL: `https://qrlia.dev.castlesoft.eu/api/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `qrc_session`

## Request body

- object
  - `url` string, uri, required
  - `events` string[], required
  - `active` boolean
  - `scope` 'tenant' | 'company', required
  - `companyId` string, uuid

## Response `201`

Created (with secret)

- WebhookCreated
  - `id` string, uuid, required
  - `url` string, uri, required
  - `events` string[], required
  - `active` boolean, required
  - `companyId` string, uuid, nullable, required
  - `createdAt` string, date-time, required
  - `lastFiredAt` string, date-time, nullable, required
  - `lastStatus` integer, nullable, required
  - `secret` string, required: HMAC signing secret. Shown ONCE — store it now.

## Other responses

- `400`: Validation failed
- `401`: Authentication required
- `403`: Forbidden
- `404`: Not found
- `409`: Conflict
- `500`: Internal

---

[API](https://skmtc.dev/qrlia/apis/qrlia-api.md) · [All operations](https://skmtc.dev/qrlia/apis/qrlia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qrlia/apis/qrlia-api/revisions/01c5dd6002ab?raw)