---
title: "Register a webhook endpoint"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Register a webhook endpoint

`POST /webhooks`

## Request

- Base URL: `https://sitesplaced.com/api/v1`
- URL: `https://sitesplaced.com/api/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

Secret key. Permission `webhooks:write`. `url` must be public https. The `secret` in the response is shown once. Deliveries are attempted once, with an 8 second timeout, and redirects are not followed: poll `GET /orders?updated_since=` as a backstop.

## Request body

- WebhookCreate
  - `url` string, uri, required: Must be public https.
  - `events` WebhookEvent[]

## Response `201`

The endpoint, with its signing secret.

- WebhookCreated
  - `id` string, uuid, required
  - `url` string, uri, required
  - `events` WebhookEvent[], required
  - `secret` string, required: Shown once.

## Other responses

- `400`: `invalid_request`. The request is malformed or a field has a bad value; `param` names the field.
- `401`: `unauthorized`. The key is missing, wrong or revoked.
- `403`: `forbidden`. The key may not do this: a secret key sent from a browser, a publishable key from a website not on its list, the wrong kind of key, or a missing permission.
- `409`: `conflict`.
- `413`: `payload_too_large`. Bodies can be up to 1 MB.
- `429`: `rate_limited`. Wait for `Retry-After` seconds.
- `500`: `internal_error`.
- `503`: `unavailable`.

---

[API](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api.md) · [All operations](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sitesplaced/apis/sitesplaced-developer-api/revisions/66fbfbbaad1a?raw)