POST /v1/webhook_endpoints

curl -X POST \
  -H "Authorization: Bearer $SECAPI_BEARER_TOKEN" \
  -H "secapi-version: 2026-03-19" \
  -H "content-type: application/json" \
  -d '{"destinationUrl":"https://example.com/hooks/secapi","description":"Production monitor matches","subscribedEventTypes":["monitor.match"],"livemode":false}' \
  "https://api.secapi.ai/v1/webhook_endpoints"

{
  "object": "webhook_endpoint",
  "id": "wh_2ZK8Q1W9F4M6P7R3",
  "createdAt": "2026-06-25T15:00:00.000Z",
  "updatedAt": "2026-06-25T15:00:00.000Z",
  "livemode": false,
  "orgId": "org_example_123",
  "description": "Production monitor matches",
  "destinationUrl": "https://example.com/hooks/secapi",
  "subscribedEventTypes": [
    "monitor.match",
    "webhook.test"
  ],
  "status": "active",
  "lastDeliveredAt": null,
  "signingSecret": "whsec_example_reveal_once_on_create_or_rotate",
  "requestId": "req_2ZK8Q1W9F4M6P7R3"
}

Create a signed webhook endpoint for Delivery events

Audience: application and admin.

Destination and secret

destinationUrl must be a public HTTPS URL; self-serve endpoints use the default HTTPS port. Select only public-emitting event types from the event catalog, using exact names, *, or namespace wildcards such as monitor.*. The response exposes signingSecret once. Store it in your receiver’s secret manager before enabling production processing; later reads do not reveal it. Invalid destinations and event filters return 400; exceeding the active target allowance returns 402 delivery_target_limit_exceeded with plan and limit details. Creating an endpoint configures a target and does not establish an uptime or delivery guarantee.

Receiving and verifying events

Webhook requests contain the JSON event body plus x-secapi-event-id, x-secapi-event-type, x-secapi-signature, x-secapi-signature-timestamp, and x-request-id. Verify the HMAC signature against the exact raw body and timestamp before parsing or applying the event. Use the event id for receiver-side idempotency.

Canonical metadata

requestId
traceparent

Example request

curl -X POST \
  -H "Authorization: Bearer $SECAPI_BEARER_TOKEN" \
  -H "secapi-version: 2026-03-19" \
  -H "content-type: application/json" \
  -d '{"destinationUrl":"https://example.com/hooks/secapi","description":"Production monitor matches","subscribedEventTypes":["monitor.match"],"livemode":false}' \
  "https://api.secapi.ai/v1/webhook_endpoints"

This organization control-plane action accepts bearer organization REST authentication. API keys cannot mutate webhook endpoints. The dashboard is optional.

Example response

{
  "object": "webhook_endpoint",
  "id": "wh_2ZK8Q1W9F4M6P7R3",
  "createdAt": "2026-06-25T15:00:00.000Z",
  "updatedAt": "2026-06-25T15:00:00.000Z",
  "livemode": false,
  "orgId": "org_example_123",
  "description": "Production monitor matches",
  "destinationUrl": "https://example.com/hooks/secapi",
  "subscribedEventTypes": [
    "monitor.match",
    "webhook.test"
  ],
  "status": "active",
  "lastDeliveredAt": null,
  "signingSecret": "whsec_example_reveal_once_on_create_or_rotate",
  "requestId": "req_2ZK8Q1W9F4M6P7R3"
}

Give this prompt to your agent

Failure posture

treat non-2xx responses as contract-aware failures, not free-form errors
preserve requestId and traceparent in logs and downstream reports
if provenance or freshness metadata is present, return it unchanged so trust is not lost in the handoff

GET /v1/webhook_endpoints PATCH /v1/webhook_endpoints/{webhook_id}

​Destination and secret

​Receiving and verifying events

​Canonical metadata

​Example request

​Example response

​Give this prompt to your agent

​Failure posture

Destination and secret

Receiving and verifying events

Canonical metadata

Example request

Example response

Give this prompt to your agent

Failure posture