---
title: "Create an outbound webhook"
method: POST
path: "/api/v1/user/webhooks"
tags: ["User", "Webhooks"]
---

# Create an outbound webhook

`POST /api/v1/user/webhooks`

Validates HTTPS destination against SSRF, accepts only the explicit payload-contract 1.0 event allowlist, and atomically stores both the encrypted signing secret and an encrypted 24-hour idempotency replay. An identical Idempotency-Key retry returns the same secret without creating a second webhook. Wildcards and unknown events fail closed with 400.

## Headers

- `X-CSRF-Token` string, required
- `Idempotency-Key` string, required

## Request body

- OutboundWebhookCreateRequest
  - `url` string, uri, required
  - `events` OutboundWebhookEventTypeV1[], required — Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.

## Response `201`

Created, or the exact signing secret replayed for the same key and payload

- OutboundWebhookOneTimeResponse
  - `ok` true, required
  - `webhook` object, required
    - `id` integer, required
    - `secret` string, required — Visible only in the original mutation response and identical Idempotency-Key replays during the 24-hour recovery window; never returned by list/get.
    - `key_id` string, required
    - `events` OutboundWebhookEventTypeV1[] — Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.
  - `secret_visible_once` true, required
  - `idempotency_replayed` boolean, required
  - `idempotency_expires_at` integer, required — Unix timestamp for the encrypted replay window.

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `403` — Invalid CSRF token
- `409` — Idempotency-Key payload conflict or expired replay window
- `429` — Rate limit exceeded
- `503` — Webhook service, secret keyring, or durable idempotency schema/keyring unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)