---
title: "Create webhook"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create webhook

`POST /webhooks`

Creates a new webhook

Required permissions:
 - `developer:manage_webhook`

## Request body

- object — Parameters for CreateWebhook
  - `api_version` 'v1' | 'v2' | 'v5' — The different API versions
  - `child_resource_events` boolean, nullable — Whether or not to send events for child resources. For example, if the webhook is created for a Company, enabling this will only send events from the Company's sub-merchants (child companies).
  - `enabled` boolean, nullable — Whether or not the webhook is enabled.
  - `events` WebhookEvent[], nullable — The events to send the webhook for.
  - `resource_id` string, nullable — The resource to create the webhook for. By default this will use current company
  - `url` string, required — The URL to send the webhook to.

## Response `200`

A successful response

- object — A webhook endpoint that receives event notifications for a company via HTTP POST.
  - `api_version` 'v1' | 'v2' | 'v5', required — The different API versions
  - `child_resource_events` boolean, required — Whether events are sent for child resources. For example, if the webhook is on a company, enabling this sends events only from the company's sub-merchants (child companies).
  - `created_at` string, date-time, required — The datetime the webhook was created.
  - `enabled` boolean, required — Whether this webhook endpoint is currently active and receiving events.
  - `events` WebhookEvent[], required — The list of event types this webhook is subscribed to.
  - `id` string, required — The unique identifier for the webhook.
  - `resource_id` string, required — The ID of the resource (company or product) this webhook is attached to.
  - `testable_events` WebhookEvent[], required — The subset of subscribed event types that support sending test payloads.
  - `url` string, required — The destination URL where webhook payloads are delivered via HTTP POST.
  - `webhook_secret` string, required — The secret key used to sign webhook payloads for verification. Include this in your HMAC validation logic.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `422` — Verification required
- `429` — Too many requests
- `500` — Internal server error

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/3a06a605784b/schema)