> ## Documentation Index
> Fetch the complete documentation index at: https://docs.secapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/webhook_endpoints

> Create a signed webhook endpoint for Delivery events

Create a signed webhook endpoint for Delivery events

<Info>
  Audience: application and admin.
</Info>

## Destination and secret

`destinationUrl` must be a public HTTPS URL; self-serve endpoints use the default HTTPS port. Select only public-emitting event types from the event catalog, using exact names, `*`, or namespace wildcards such as `monitor.*`.

The response exposes `signingSecret` once. Store it in your receiver's secret manager before enabling production processing; later reads do not reveal it. Invalid destinations and event filters return `400`; exceeding the active target allowance returns `402 delivery_target_limit_exceeded` with plan and limit details. Creating an endpoint configures a target and does not establish an uptime or delivery guarantee.

## Receiving and verifying events

Webhook requests contain the JSON event body plus `x-secapi-event-id`, `x-secapi-event-type`, `x-secapi-signature`, `x-secapi-signature-timestamp`, and `x-request-id`. Verify the HMAC signature against the exact raw body and timestamp before parsing or applying the event. Use the event id for receiver-side idempotency.

## Canonical metadata

* `requestId`
* `traceparent`

## Example request

<RequestExample>
  ```bash theme={null}
  curl -X POST \
    -H "Authorization: Bearer $SECAPI_BEARER_TOKEN" \
    -H "secapi-version: 2026-03-19" \
    -H "content-type: application/json" \
    -d '{"destinationUrl":"https://example.com/hooks/secapi","description":"Production monitor matches","subscribedEventTypes":["monitor.match"],"livemode":false}' \
    "https://api.secapi.ai/v1/webhook_endpoints"
  ```
</RequestExample>

<Info>
  This organization control-plane action accepts bearer organization REST authentication. API keys cannot mutate webhook endpoints. The dashboard is optional.
</Info>

## Example response

<ResponseExample>
  ```json theme={null}
  {
    "object": "webhook_endpoint",
    "id": "wh_2ZK8Q1W9F4M6P7R3",
    "createdAt": "2026-06-25T15:00:00.000Z",
    "updatedAt": "2026-06-25T15:00:00.000Z",
    "livemode": false,
    "orgId": "org_example_123",
    "description": "Production monitor matches",
    "destinationUrl": "https://example.com/hooks/secapi",
    "subscribedEventTypes": [
      "monitor.match",
      "webhook.test"
    ],
    "status": "active",
    "lastDeliveredAt": null,
    "signingSecret": "whsec_example_reveal_once_on_create_or_rotate",
    "requestId": "req_2ZK8Q1W9F4M6P7R3"
  }
  ```
</ResponseExample>

## Give this prompt to your agent

<Prompt>
  Create the HTTPS destination and public-emitting event filters with bearer organization REST authentication. API keys cannot mutate webhook endpoints; the dashboard is optional. Store the returned signing secret immediately because it is revealed only on creation or rotation.
</Prompt>

## Failure posture

* treat non-2xx responses as contract-aware failures, not free-form errors
* preserve `requestId` and `traceparent` in logs and downstream reports
* if provenance or freshness metadata is present, return it unchanged so trust is not lost in the handoff