---
title: "Register a public HTTPS endpoint and obtain its signing secret once"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Register a public HTTPS endpoint and obtain its signing secret once

`POST /webhooks`

## Request

- Base URL: `https://www.sanctionskit.com/api/v1`
- URL: `https://www.sanctionskit.com/api/v1/webhooks`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sanctionskit/apis/sanctionskit-api/docs/webhooks/post.ts> (a function with typed inputs; its response is checked against the schema)

Required API key scope: webhooks:write.

## Request body

- WebhookRequest
  - `url` string, uri, required: HTTPS endpoint that receives signed events. Public DNS resolution and destination restrictions apply; local/private addresses and redirects are rejected. At most five active endpoints per environment.

## Response `201`

Successful response. JSON object with the required data key. All properties marked required are present, including keys whose value may be null. Unmarked properties can be omitted; clients should tolerate additional response properties.

- object
  - `data` WebhookCreated, required
    - `id` string, uuid, required
    - `environment` 'sandbox' | 'production', required
    - `url` string, required
    - `secret` string, required: Signing secret shown only at creation. Store securely and use it to verify webhook signatures; list operations never return it.

## Other responses

- `400`: **invalid_request** — Correct the request fields, resource identifiers, JSON body or query parameters before retrying. **invalid_webhook** — Use a public HTTPS endpoint without private or reserved destinations.
- `401`: **authentication_required** — Send Authorization: Bearer with a valid API key. An omitted header can produce authentication_required; invalid supplied credentials produce invalid_api_key. **invalid_api_key** — Use an active key for the intended environment.
- `403`: **permission_denied** — Ask an organization owner to grant the required role or API-key scope. **insufficient_scope** — Use a key with the scope stated in this operation.
- `405`: **method_not_allowed** — Use a method in the Allow response header. OPTIONS lists supported methods; HEAD follows GET authorization and returns no body.
- `408`: **invalid_request** — Reconnect and retry using the same idempotency key and identical input where supported.
- `409`: **webhook_limit_reached** — Disable an unused endpoint before adding another.
- `413`: **response_too_large** — Reduce the requested page size or use the documented segmented case archive. No evidence is silently truncated. **invalid_request** — Reduce the JSON request size to the documented limit.
- `415`: **invalid_request** — Use Content-Type: application/json and an uncompressed UTF-8 body.
- `429`: **rate_limited** — Wait for the request window to reset and retry with backoff.
- `500`: **internal_error** — Retry with backoff. For writes reuse the same idempotency key and identical input; include requestId when contacting support.
- `503`: **temporarily_unavailable** — Honor Retry-After when present and retry with bounded backoff. Follow this endpoint’s retry contract; preserve the same key and input for idempotent writes. Contact support with requestId if the failure persists.

---

[API](https://skmtc.dev/sanctionskit/apis/sanctionskit-api.md) - [All operations](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/revisions/ee35d211051a?raw)