---
title: "Create or repoint the scan webhook"
method: PUT
path: "/api/webhook"
tags: ["Webhooks"]
---

# Create or repoint the scan webhook

`PUT /api/webhook`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/webhook`
- Auth: HTTP bearer

Idempotent: one endpoint per workspace, so this creates or replaces. Changing the URL KEEPS the
signing secret, so moving from a staging host to a production one does not require redeploying
verification code, and saving clears a failure state — re-saving is how a customer switches a
disabled endpoint back on.

The URL must be `https://`, must not carry credentials, and must not resolve to loopback,
link-local, carrier-grade-NAT or RFC1918 space. We are making requests to a URL the customer
chose, which is a server-side request forgery primitive by construction; refusals come back as
400 with a message written for the customer, and the same check runs again before every
delivery because DNS can be repointed after saving.

## Request body

- object
  - `url` string, uri, required
  - `enabled` boolean

## Response `200`

Saved.

- object
  - `url` string
  - `secret` string
  - `enabled` boolean

## Other responses

- `400`: Request did not match the Zod validation schema
- `401`: No valid session
- `402`: Webhooks are a Pro-and-above entitlement.

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)