---
title: "Create a webhook"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /webhooks`

As with all POST endpoints, a location header will be returned with a url to the newly created resource.

## Request body

- object
  - `events` unknown[], required — An array of one or more of the following event types: `candidate.created`, `job.created`, `contact.created`, `company.created`, `activity.created`, `user.created`, `pipeline.created`, `candidate.updated`, `job.updated`, `contact.updated`, `company.updated`, `activity.updated`, `user.updated`, `candidate.deleted`, `job.deleted`, `contact.deleted`, `company.deleted`, `activity.deleted`, `user.deleted`, `pipeline.deleted`, `job.status_changed`, `contact.status_changed`, `company.status_changed`, `pipeline.status_changed`
    - unknown
  - `target_url` string, required — URL to post the record to once the event is triggered.
  - `secret` string — ***Highly Recommended***. If provided, you can use this string to verify that authenticity of webhooks sent to `target_url`. All webhooks you subscribe to you will send a `X-Signature` header. To determine whether the `X-Signature` header is valid take the body of the webhook response, append the value of the `X-Request-Id` header to it, and then generate a `HMAC-SHA256` hash of it using your secret as a key. That final result should match the hash found in the `X-Signature` header. Here are two examples of the verification process in PHP and Python 3: ```PHP $secret = 'yourSecretHere'; $webhookBody = '{}'; // `X-Request-Id` header $requestId = '5d6ce3f9-cce8-4b5b-a26e-396a6161eb99'; // `X-Signature` header $signature = 'HMAC-SHA256 affc8d589f36580daa0d587ac0b314c123b59322cf4d018661e0a403cc76391f'; $hash = hash_hmac('sha256', $requestBody . $requestId, $secret, false); if ($signature !== 'HMAC-SHA256 ' . $hash) { // Reject it } ```

## Response `201`

Created

---

[API](https://skmtc.net/catsone/apis/cats-api-v3.md) · [All operations](https://skmtc.net/catsone/apis/cats-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/catsone/cats-api-v3/revisions/dedbbade450d/schema)