---
title: "Create a webhook"
method: POST
path: "/api/v1/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /api/v1/webhooks`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `webhooks:write`)

Register an endpoint to receive HMAC-signed deliveries for the events named in `event_types`.

The response carries the signing secret ONCE. It is shown here and by `POST /api/v1/webhooks/{id}/rotate-secret`, and by nothing else — no endpoint reads it back, so store it now. A secret you have lost is replaced by rotating, not recovered.

Requires the `webhooks:write` scope — Create, edit, and delete your webhook endpoints.

## Request body

- WebhookV1Create: Body for POST /api/v1/webhooks.
  - `event_types` string[], required
  - `url` string, uri, required

## Response `201`

The created webhook and its one-time signing secret

- WebhookV1Created: A newly created webhook and its one-time signing secret.
  - `secret` string, required: The signing secret, shown EXACTLY ONCE. Store it now — no endpoint returns it again.
  - `webhook` WebhookV1, required: A webhook endpoint as exposed on the v1 API. The signing secret is NEVER on this shape — it is returned once, by create and by rotate, and no endpoint reads it back.
    - `created_at` string, date-time, required
    - `event_types` string[], required
    - `id` string, uuid, required
    - `status` 'ACTIVE' | 'PAUSED' | 'DISABLED', required
    - `updated_at` string, date-time, required
    - `url` string, required

## Other responses

- `401`: `invalid_api_key` or `invalid_session` — missing or invalid credentials.
- `403`: `scope_missing`, `project_access_denied`, or `project_disabled`.
- `422`: `validation_error` — query, path, or body parameters did not match the schema.
- `429`: `rate_limited` — see `Retry-After` and the `RateLimit` headers.
- `500`: `internal_error`.

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)