---
title: "Create Webhook"
method: POST
path: "/api/v2/webhooks"
tags: ["Webhooks"]
---

# Create Webhook

`POST /api/v2/webhooks`

Register a new webhook for a given event type. Auth secrets are encrypted before storage. Limited to 10 webhooks per API key.

## Request body

- WebhookCreateRequest — Validates the payload for creating a new webhook. Required fields: ``url``, ``event_type``, ``is_test``. Optional fields: ``header_name``, ``prefix``, ``auth_secret``.
  - `url` string, uri, required
  - `event_type` 'clientview_updated' | 'incremental_update' | 'series_updated' | 'document_added', required — * `clientview_updated` - Clientview Updated * `incremental_update` - Incremental Update * `series_updated` - Series Updated * `document_added` - Document Added
  - `is_test` boolean, required
  - `header_name` string
  - `prefix` string
  - `auth_secret` string

## Response `201`

- WebhookFullRead — Read-only serializer for webhook responses (list, retrieve, create, update). ``masked_auth_secret`` is a pre-computed field stored on the model that exposes only the last 4 characters of the auth secret (e.g. ``"****7890"``). Secrets of 4 or fewer characters are fully masked as ``"****"``. This avoids decrypting the auth secret on every read request.
  - `id` integer, required
  - `event_type` string, required
  - `active` boolean, required
  - `is_test` boolean, required
  - `url` string, uri, required
  - `header_name` string, required
  - `prefix` string, required
  - `masked_auth_secret` string, required
  - `created_at` string, date-time, required

## Other responses

- `400`
- `401`
- `403`
- `429`

---

[API](https://skmtc.net/daloopa/apis/daloopa-api.md) · [All operations](https://skmtc.net/daloopa/apis/daloopa-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/daloopa/daloopa-api/versions/746538a1eb45/schema)