---
title: "Add Company"
method: POST
path: "/companies"
tags: ["Company Management"]
---

# Add Company

`POST /companies`

Add a new company to the authenticated user's account. The request must include the company `name` and at least one initial asset value across `domains`, `apks`, and/or `external_domains`.

If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`.

## Request body

- object — At least one of `domains`, `apks`, or `external_domains` must contain at least one value.
  - `name` string, required — Display name of the new company. Alphanumeric only (no spaces or special characters), 1-100 characters.
  - `domains` string[] — Initial primary domains for the company
  - `apks` string[] — Initial APK package names for the company
  - `external_domains` string[] — Initial external (third-party) domains for the company
  - `webhook` object — Optional webhook configuration for this company. If provided, both `url` and `token` are required.
    - `url` string, uri, required — HTTPS URL to receive webhook notifications.
    - `token` string, required — Token sent with each webhook request to authenticate it (e.g. a Splunk HEC token or bearer token).
    - `auth_header` string — Name of the HTTP header used to send the token. Defaults to "Authorization" if not specified.

## Response `200`

Updated list of companies for the authenticated user

- object
  - `companies` Company[]
    - `_id` string — ObjectId of the company
    - `name` string — Display name of the company
    - `data` object — Company assets used to scope searches
      - `domains` string[] — Primary domains owned by the company
      - `apks` string[] — Android application package names associated with the company
      - `external_domains` string[] — External (third-party) domains associated with the company
      - `webhook` Webhook, nullable — Webhook configuration for notifying an external endpoint of events related to a company. Null if not configured.
        - `url` string, uri — HTTPS URL to receive webhook notifications.
        - `token` string — Token sent with each webhook request to authenticate it (e.g. a Splunk HEC token or bearer token).
        - `auth_header` string — Name of the HTTP header used to send the token. Defaults to "Authorization" if not specified.

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `409` — Conflict - the request conflicts with the current state of the resource
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/versions/5ba0142eec4d/schema)