---
title: "Create webhook"
method: POST
path: "/webhooks"
tags: ["webhooks"]
---

# Create webhook

`POST /webhooks`

Creates a new webhook in the workspace associated with the Management API key.
Webhook needs to be verified before it will start sending identification events to your server. See webhook verification.
If webhook signatures are enabled (enterprise only), signing key will be visible in the response after creation. When fetching webhooks after creation, signing key will not be visible!
See webhooks documentation for more details.
When specifying an environment during creation, webhook should be assigned to the given environment. Setting environment to null creates a global webhook.

## Headers

- `X-API-Version` string, required

## Request body

- CreateWebhookDtoV1
  - `url` string, required — URL of the webhook endpoint. Must start with https://.
  - `description` string — Description of the webhook.
  - `status` 'enabled' | 'disabled' — Status of the webhook: 'enabled' or 'disabled'.
  - `environment` object — Environment ID this webhook is associated with. Null if global.

## Response `201`

Webhook created, but needs to be verified before it's active.

- WebhookResponse
  - `data` WebhookEntityV1, required
    - `id` string, required — Webhook ID.
    - `description` string, required — Description of the webhook.
    - `status` 'enabled' | 'disabled', required — Status of the webhook: 'enabled' or 'disabled'.
    - `verified` boolean, required — Indicates if the webhook endpoint has been verified.
    - `environment` object, required — Environment ID this webhook is associated with. Null if global.
    - `url` string, required — URL of the webhook endpoint. Must start with https://.
    - `legacy` boolean, required — True if webhook is legacy. See docs for more details.
    - `signing_key` string — The signing key for verifying webhook payloads. Will only be returned on creation. See docs for more details.
    - `basic_auth` object, nullable, required — Basic authentication credentials. Only applies to legacy webhooks.
    - `created_at` string, date-time, required — Timestamp of when the webhook was created.
    - `last_enabled_at` object, nullable — Timestamp of when the webhook was last enabled.
    - `last_disabled_at` object, nullable — Timestamp of when the webhook was last disabled.
  - `environment` object, nullable, required — Environment ID this webhook is associated with. Null if global.

## Other responses

- `400` — Error: Bad request.
- `401` — Unauthorized. API key is invalid.
- `403` — Forbidden. Insufficient permissions.
- `404` — Webhook does not exist.
- `422` — Error: Payload parameters are invalid.
- `429` — Error: API key has exceeded its rate limit.

---

[API](https://skmtc.net/fingerprint/apis/management-api.md) · [All operations](https://skmtc.net/fingerprint/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/fingerprint/management-api/versions/b17eccec9d47/schema)