---
title: "Create a webhook"
method: POST
path: "/api/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /api/webhooks`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `webhooks:write`)

Register a new outbound webhook. The plaintext signing secret is returned exactly once — store it securely.

Requires the `webhooks:write` scope — Create, edit, and delete your webhook endpoints.

## Request body

- CreateWebhook: Body for POST /api/webhooks — register a user webhook for one or more events.
  - `eventTypes` string[], required
  - `url` string, uri, required

## Response `201`

Webhook created

- WebhookCreateResponse: Result of POST /api/webhooks. `secret` is the only time the plaintext is returned — store it securely.
  - `data` object, required
    - `secret` string, required: Plaintext shared secret. Returned ONCE on create.
    - `webhook` Webhook, required: A user-managed outbound webhook. Never carries a secret.
      - `consecutiveFailures` integer, required
      - `createdAt` string, date-time, required: ISO 8601 datetime string
      - `disabledAt` string, date-time, nullable: ISO 8601 datetime string
      - `domains` string[], required: Sending domains this endpoint is scoped to. Empty means every domain on the project.
      - `eventTypes` string[], required
      - `id` string, uuid, required
      - `previousSecretExpiresAt` string, date-time, nullable: While a rotation is in flight, when the OLD secret stops being accepted. `null` outside a rotation.
      - `projectId` string, uuid, required
      - `status` 'ACTIVE' | 'PAUSED' | 'DISABLED', required
      - `updatedAt` string, date-time, required: ISO 8601 datetime string
      - `url` string, uri, required
  - `success` true, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)