Skip to main content
POST

Request Body

string
required
The HTTPS endpoint URL that will receive webhook events.
array
required
List of event types to subscribe to. See Event Types for all available events.
boolean
default:"true"
Whether the webhook should start receiving events immediately.

Response

Returns the created webhook including the secret field. The secret is only returned on creation — save it securely for signature verification.
Save the secret value immediately. It is only returned in this response and cannot be retrieved later. You’ll need it to verify webhook signatures.

Errors

Available Event Types

Rate Limit

  • 100 requests per minute, per API key. Fixed 60-second window.
  • Every response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset (unix epoch seconds).
  • A 429 response includes a Retry-After header (seconds until the bucket resets).
For client-side patterns (Retry-After, exponential backoff, monitoring X-RateLimit-Remaining), see Rate Limiting.