Register an endpoint (up to 10)
Tokens limited to chosen documents can't register endpoints (403). Deliveries are signed: Handwrite-Signature: t=,v1=<hex HMAC-SHA256 of "t.body">.
App integration: Compatibility note (2026-10-26): the published OpenAPI still lists this operation, but current working-tree code rejects new personal-account receivers with 403 webhooks_moved. New receivers belong to teams/classes and are created by an administrator through the organisation Developer tab. Previously created personal receivers continue to work in that code. This change has not been verified against the live runtime. The reference below preserves the published contract; do not assume new personal registration is available. Where creation is supported, store the returned signing secret immediately; it is shown only once. Maximum 10 endpoints. Document-limited tokens cannot register receivers. Validate signatures on raw bytes and durably deduplicate event IDs before processing.
Request
Responses
curl --location '/api/v1/webhooks' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
"url": "http://example.com",
"events": [
"document.created"
]
}'{
"webhook": {
"id": "string",
"url": "http://example.com",
"events": [
"document.created"
],
"createdAt": "2019-08-24T14:15:22.123Z",
"lastDelivery": {
"at": "2019-08-24T14:15:22.123Z",
"outcome": "delivered",
"statusCode": 0,
"error": "string",
"eventId": "string"
}
},
"secret": "string"
}