Skip to main content
POST

Behavior

Each event in enabled_events arrives as a signed POST, with the payload and signature check in Webhooks. The secret is returned once and cannot be retrieved later. To replace it, use Rotate secret.

Request body

string
required
Target URL for deliveries, up to 2048 characters. Must be https:// and publicly reachable: the platform sends a HEAD request at creation time and rejects the webhook if the endpoint cannot be reached. Any HTTP status counts as reachable. Your endpoint does not need to accept HEAD.
string[]
default:["*"]
Event types delivered to this webhook. "*" subscribes to the session.status_updated firehose. Granular session.* types are delivered only when named explicitly (Event types).
string
Label for the webhook, up to 255 characters.

Response

201 with the created webhook object plus its secret.

Errors