---
title: "Register a webhook"
method: POST
path: "/api/webhooks"
tags: ["Webhooks"]
---

# Register a webhook

`POST /api/webhooks`

The signing `secret` is returned ONCE at creation. Deliveries include header `X-Invovate-Signature: sha256=<hmac over raw body>`.

## Request body

- WebhookCreate
  - `url` string, required — https:// endpoint.
  - `events` string[]

## Response `201`

Created.

- object
  - `success` unknown
  - `webhook` WebhookWithSecret
    - `id` string
    - `url` string
    - `events` string[]
    - `is_active` boolean
    - `created_at` integer
    - `last_delivery_at` integer
    - `last_status` integer
    - `secret_hint` string
    - `secret` string — Returned once, at creation.

## Other responses

- `400` — Error.

---

[API](https://skmtc.net/invovate/apis/invovate-invoice-api.md) · [All operations](https://skmtc.net/invovate/apis/invovate-invoice-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/invovate/invovate-invoice-api/versions/9d493e278f33/schema)