---
title: "Create a webhook endpoint"
method: POST
path: "/v1/webhook_endpoints"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /v1/webhook_endpoints`

## Request

- Base URL: `https://api.tryleap.ai`
- URL: `https://api.tryleap.ai/v1/webhook_endpoints`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Starts sending your workspace's events to an https URL: every type by default (`["*"]`, including types added later), or the ones you list. Runs started from the API, the studio and MCP all send events. The answer holds the endpoint's signing secret, shown only here and when you rotate it. A workspace can have up to 16 endpoints; one more answers `409`.

Needs an API key with the `generations:write` scope.

## Request body

- WebhookEndpointRequest
  - `url` string, uri, required: Where Leap POSTs events: an https URL that answers 2xx within 15 seconds.
  - `events` string[]: The event types to send. ["*"], the default, sends every type, including types added later.
  - `description` string, nullable: A note for people, such as which app this is.

## Response `201`

The endpoint, with its signing secret.

- WebhookEndpointWithSecret: An endpoint with its signing secret, as create and rotate_secret return it.
  - `id` string, required: The endpoint's ID, `we_...`.
  - `object` 'webhook_endpoint', required
  - `url` string, required: Where Leap POSTs events.
  - `description` string, nullable, required: Your note, if any.
  - `events` string[], required: The event types it gets; ["*"] for every type, including types added later.
  - `disabled` boolean, required: Whether deliveries to it are stopped.
  - `disabled_reason` string, nullable, required: Why Leap disabled the endpoint, such as every delivery failing for 72 hours; null when it is on or you turned it off.
  - `created_at` string, date-time, required: When it was created.
  - `updated_at` string, date-time, required: When it last changed.
  - `secret` string, required: The signing secret, whsec_ and base64. Shown only here: keep it in your server's environment.

## Other responses

- `400`: `invalid_parameter`, `conflicting_credentials`
- `401`: `authentication_required`
- `403`: `permission_denied`
- `409`: `conflict`
- `429`: `rate_limit_exceeded`

---

[API](https://skmtc.dev/tryleap/apis/leap-api.md) · [All operations](https://skmtc.dev/tryleap/apis/leap-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tryleap/apis/leap-api/revisions/c01f98d3e835?raw)