---
title: "Create Webhook Endpoint"
method: POST
path: "/v1/webhook-endpoints"
tags: ["manufacturing-v1"]
---

# Create Webhook Endpoint

`POST /v1/webhook-endpoints`

## Request

- Base URL: `https://api.rmfg.com`
- URL: `https://api.rmfg.com/v1/webhook-endpoints`
- Auth: HTTP bearer

Register a URL for lifecycle events. The signing `secret` is returned
once, here; store it to verify `X-RMFG-Signature`.

## Request body

- V1WebhookEndpointCreateRequest
  - `url` string, required: HTTPS URL that receives POSTed events.
  - `events` string[], required: Event types to deliver to this endpoint: design.ready, design.failed, dfm_report.production_files.ready, dfm_report.production_files.failed, quote.ready, quote.failed, cart.checked_out, order.status_changed.
  - `description` string, nullable

## Response `201`

Endpoint created; `secret` shown once.

- V1WebhookEndpoint: Where lifecycle events are posted for this API caller. Deliveries are signed: `X-RMFG-Signature: v1=<hex HMAC-SHA256 of "<X-RMFG-Timestamp>.<raw body>" using the endpoint secret>`. The body is `{id, type, created_at, data}`; `data.status_url` points at the resource to fetch, so a receiver never needs to trust the payload alone. Failed deliveries retry after 1m, 5m, 30m, 2h, and 8h.
  - `id` string, required
  - `object` 'webhook_endpoint'
  - `url` string, required
  - `events` string[], required
  - `description` string, nullable
  - `active` boolean
  - `secret` string, nullable: Signing secret; returned only when the endpoint is created.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, nullable

## Other responses

- `400`: Malformed request.
- `401`: Missing or invalid credentials.
- `403`: The credentials do not permit this operation.
- `404`: The resource does not exist or is not visible to the caller.
- `409`: The resource is not ready, or Idempotency-Key was reused with a different request.
- `422`: Validation failed; see `error.param` and `error.details`.
- `429`: Rate limit exceeded; retry after the `Retry-After` header.
- `500`: Unexpected failure; safe to retry with the same Idempotency-Key.
- `503`: A dependency is temporarily unavailable; retry later.

## Changes

- **2026-09-28** `3568b01e288d`: 2 warning
  - added the new `bend_program.completed` enum value to the `events/items/` response property for the response status `201`
  - added the new `bend_program.failed` enum value to the `events/items/` response property for the response status `201`
- **2026-09-06** `b7e901150c5c`: 5 breaking, 10 warning, 19 info
  - the request property `events` became required
  - request property `events` list-of-types was narrowed by removing types `null` from media type `application/json`
  - the `events` request property's minItems was increased to `1`
  - the `url` request property's minLength was increased from `0` to `12`
  - …30 more

[Operation history](https://skmtc.dev/rmfg/apis/rmfg-manufacturing-api/changes/v1/webhook-endpoints/post.md)

---

[API](https://skmtc.dev/rmfg/apis/rmfg-manufacturing-api.md) - [All operations](https://skmtc.dev/rmfg/apis/rmfg-manufacturing-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rmfg/apis/rmfg-manufacturing-api/revisions/078f984358b9?raw)