---
title: "Create a connection's webhook URL"
method: POST
path: "/api/v1/connections/{connection_id}/trigger-ingress"
tags: ["Triggers"]
---

# Create a connection's webhook URL

`POST /api/v1/connections/{connection_id}/trigger-ingress`

## Request

- Base URL: `https://$SCALEKIT_ENVIRONMENT_URL`
- URL: `https://$SCALEKIT_ENVIRONMENT_URL/api/v1/connections/{connection_id}/trigger-ingress`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://$SCALEKIT_ENVIRONMENT_URL/oauth/token`
- TypeScript: <https://skmtc.dev/scalekit/apis/scalekit-api-reference/docs/api/v1/connections/:connection_id/trigger-ingress/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates the webhook URL a provider sends this connection's events to. Use this endpoint once per connection when you set up a webhook trigger: paste the returned URL into the provider's app configuration, then store the provider's signing secret with SetTriggerSigningSecret. Pass the connection ID in the path; the request has no body. Only a connection whose provider publishes at least one webhook trigger can have a webhook URL. The call is idempotent: when the connection already has a URL, that URL is returned unchanged, so a retry never replaces a URL already registered with the provider. The URL accepts request bodies up to 1 MB. Returns the endpoint ID, the URL and the signing-secret state; the signing secret itself is never returned.

## Path parameters

- `connection_id` string, required

## Response `200`

The newly created webhook URL, or the connection's existing one unchanged, with its signing-secret state

- TriggersTriggerIngressEndpoint: The webhook URL a provider sends a connection's events to, and the state of the secret those events are signed with. This message never carries the signing secret itself: masked_signing_secret shows at most its last four characters, so you can tell which secret is stored. The only response that returns a secret in plaintext is GenerateTriggerSigningSecret's, once, for a secret Scalekit generates.
  - `connection_id` string: ID of the connection this webhook URL belongs to.
  - `id` string: Unique identifier of the connection's webhook endpoint.
  - `masked_signing_secret` string: The stored secret with all but its last four characters replaced, or every character replaced for a secret of 8 characters or fewer. Present only when one is configured. Enough to compare against the secret the provider's app configuration shows, and never enough to sign with.
  - `previous_signing_secret_expires_at` string, date-time: When the previous secret stops being accepted even if the rotation is never confirmed: 24 hours after the rotation started. Absent when no rotation is in progress.
  - `rotation_in_progress` boolean: Whether the previous signing secret is still accepted alongside the current one. True from the moment a different secret replaces a stored one until the rotation is confirmed, or until previous_signing_secret_expires_at passes.
  - `signing_secret_configured` boolean: Whether a signing secret is stored. While false, every event sent to the URL is answered with 503 so the provider retries it, and the provider's own URL verification fails.
  - `signing_secret_rotation_id` string, int64: Identifies the latest signing-secret rotation; it increases by one each time a rotation starts. Zero when none has ever started. Pass this value to ConfirmTriggerSigningSecretRotation to confirm this specific rotation. A value naming a rotation that a newer one has since replaced is refused rather than confirming the wrong rotation.
  - `url` string: The URL to paste into the provider's app configuration as the event destination. It is built on your environment's domain, using its custom domain when one is set, and ends in a random token unique to this connection, so treat it as confidential. Returned whether or not a signing secret has been set. The URL accepts request bodies up to 1 MB and answers a larger one with 413. Until a signing secret is set it answers events with 503, so the provider retries them; an event that fails signature verification is answered with 400.

## Other responses

- `400`: Invalid request, nothing created - connection_id is not a valid connection ID; the connection's provider publishes no webhook trigger, so it has no use for a webhook URL (error_code TRIGGER_INGRESS_NOT_APPLICABLE); or the provider's webhook trigger definitions are temporarily unavailable (error_code TRIGGER_INGRESS_DEFINITIONS_UNAVAILABLE)
- `404`: Not found - the connection does not exist in this environment, or Triggers is not enabled for the environment
- `500`: Internal error - the webhook URL could not be created or read back; retry the request

## Changes

- **2026-10-30** `f47f1022d844`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/scalekit/apis/scalekit-api-reference/changes/api/v1/connections/:connection_id/trigger-ingress/post.md)

---

[API](https://skmtc.dev/scalekit/apis/scalekit-api-reference.md) - [All operations](https://skmtc.dev/scalekit/apis/scalekit-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/scalekit/apis/scalekit-api-reference/revisions/f47f1022d844?raw)