---
title: "Create a webhook endpoint"
method: POST
path: "/api/v1/webhook_endpoints"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /api/v1/webhook_endpoints`

## Request

- Base URL: `https://app.voicepanel.com`
- URL: `https://app.voicepanel.com/api/v1/webhook_endpoints`
- Auth: HTTP bearer

Register an HTTPS URL that receives a signed POST for each subscribed event. The response includes the signing secret once. Store it; it is not shown again.

## Request body

- WebhookEndpointCreateBody: Create a webhook endpoint
  - `account_id` string: The account that owns the endpoint. Defaults to the account of the API token.
  - `url` string, uri, required: HTTPS URL that receives a POST for each event. Private and loopback addresses are rejected.
  - `description` string: A label shown in the dashboard
  - `event_types` string[], required: Event types the endpoint receives. `response.completed` fires when a participant completes a response.

## Response `201`

The endpoint, with its signing secret

- WebhookEndpointWithSecret: A new webhook endpoint with its signing secret
  - `id` string, required: The webhook endpoint ID
  - `account_id` string, required: The account that owns the endpoint
  - `url` string, required: HTTPS URL that receives a POST for each event
  - `description` string, nullable, required: A label shown in the dashboard
  - `event_types` string[], required: Event types the endpoint receives
  - `enabled` boolean, required: False when deliveries are stopped, by you or after failures
  - `disabled_at` string, date-time, nullable, required: When the endpoint was disabled
  - `disabled_reason` 'endpoint_returned_410' | 'failing_for_7_days' | 'manual', nullable, required: Why the endpoint was disabled
  - `consecutive_failures` integer, required: Failed deliveries since the last success
  - `last_success_at` string, date-time, nullable, required
  - `last_failure_at` string, date-time, nullable, required
  - `previous_secret_expires_at` string, date-time, nullable, required: After a rotation, when deliveries stop carrying the previous signature
  - `created_by` string, nullable, required: ID of the user who created the endpoint
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `secret` string, required: Signing secret, prefixed `whsec_`. Shown once; store it to verify deliveries.
  - `warning` string, required: Reminder that the secret is not shown again

## Other responses

- `400`: Bad request. `code` is `validation_error` when a field is invalid or a query parameter is unknown, with the field paths in `details`, or `bad_request` otherwise.
- `401`: Unauthorized. The token is missing, invalid, or has no user.
- `403`: Forbidden. The token has no access to this resource.
- `404`: Not found. The resource does not exist or belongs to another account.
- `409`: Conflict. The write disagrees with the current state of the resource.
- `429`: Too many requests. The account used its API rate limit. `code` is `too_many_requests`. Wait for the number of seconds in `Retry-After`, then retry.
- `500`: Internal error. Quote `request_id` when you contact support.
- `503`: Service unavailable. A dependency did not answer and nothing was saved. Retry later.

---

[API](https://skmtc.dev/voicepanel/apis/voicepanel-api.md) - [All operations](https://skmtc.dev/voicepanel/apis/voicepanel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/voicepanel/apis/voicepanel-api/revisions/ee41535c5694?raw)