---
title: "Create webhook subscription"
method: POST
path: "/api/webhook-subscriptions"
tags: ["Webhooks"]
---

# Create webhook subscription

`POST /api/webhook-subscriptions`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/webhook-subscriptions`
- Auth: one of:
  - API key in cookie `luca.session_token`
  - API key in header `x-api-key`
  - HTTP bearer

Subscribes a URL to one or more event types. The signing secret comes back once, so store it now. We check the target URL first and refuse private and loopback addresses.

**API key scopes:** `webhooks:write`.

## Headers

- `Luca-API-Version` '1'

## Request body

- WebhookSubscriptionCreate
  - `targetUrl` string, uri, required
  - `eventTypes` string[], required
  - `workspaceScoped` boolean
  - `consumerMetadata` object
  - `expiresAt` string, date-time

## Response `200`

ok

- WebhookSubscription
  - `id` string, uuid, required
  - `organizationId` string, required
  - `coachId` string, uuid, nullable, required
  - `targetUrl` string, required
  - `eventTypes` string[], required
  - `status` 'active' | 'paused' | 'disabled' | 'deleted', required
  - `consumerMetadata` object, required: Opaque JSON object
  - `signingSecret` string
  - `expiresAt` string, nullable, required
  - `health` 'healthy' | 'degraded' | 'down'
  - `createdAt` string, required
  - `updatedAt` string, required

## Other responses

- `400`: bad request
- `401`: unauthorized
- `429`: rate limited
- `500`: internal error
- `503`: service unavailable

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)