---
title: "Create a webhook subscription"
method: POST
path: "/api/v1/webhook-subscriptions"
tags: ["Webhooks"]
---

# Create a webhook subscription

`POST /api/v1/webhook-subscriptions`

Registers a new HTTPS endpoint to receive signed delivery
callbacks for the listed event types. Returns the HMAC `secret`
ONCE — store it securely. Subsequent reads only expose the
`secret_prefix`.

## Request body

- WebhookSubscriptionCreateRequest
  - `url` string, uri, required — HTTPS endpoint to receive deliveries. Must use `https://`, resolve to a public IP, and not use a disallowed port. See the [Webhooks guide](/docs/webhooks#url-requirements).
  - `events` WebhookEventType[] — Event types to subscribe to. Defaults to `["*"]`.
  - `description` string, nullable
  - `status` 'active' | 'disabled' — `active` subscriptions receive deliveries. `disabled` subscriptions are skipped at dispatch time — either explicitly set by the customer or set by Prezent's auto-disable rule after 50 consecutive delivery failures. PATCH `status: active` to re-enable.

## Response `201`

Subscription created. Body contains the `secret` — the only response that ever exposes it.

- WebhookSubscriptionCreateResponse — Standard success envelope. Endpoint-specific schemas extend this and constrain the `data` property to their concrete shape. Additional legacy keys (`status`, `log`, …) may appear alongside `success`/`data` for backwards compatibility, and some legacy handlers omit `success`, so it is not marked required.
  - `success` boolean — `true` on success (omitted by some legacy handlers).
  - `data` object, required — Core read-shape for a webhook subscription. Returned by GET + PATCH endpoints. Never includes the raw HMAC secret — only `secret_prefix` (the first 6 chars, for human disambiguation).
    - `id` string, required
    - `url` string, uri, required — HTTPS endpoint receiving signed deliveries.
    - `secret_prefix` string, required — First 6 characters of the HMAC secret, for human disambiguation. Always `whsec_` for current implementations.
    - `events` WebhookEventType[], required — Event types this subscription receives. Use `["*"]` to subscribe to everything, including future event types.
    - `description` string, nullable — Free-form human label for the subscription.
    - `status` 'active' | 'disabled', required — `active` subscriptions receive deliveries. `disabled` subscriptions are skipped at dispatch time — either explicitly set by the customer or set by Prezent's auto-disable rule after 50 consecutive delivery failures. PATCH `status: active` to re-enable.
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `last_delivery_at` string, date-time, nullable — Timestamp of the most recent successful delivery.
    - `last_failure_at` string, date-time, nullable — Timestamp of the most recent failed delivery.
    - `consecutive_failure_count` integer — Failures since the last successful delivery. At 50 the subscription is auto-disabled.
    - `secret` string, required — The raw HMAC secret. Returned ONCE on this endpoint and on `/rotate-secret`. Store it immediately — subsequent reads expose only `secret_prefix`.

## Other responses

- `400` — Generic client error. `error.code` is one of `BAD_REQUEST`, `INVALID_JSON`, `MISSING_REQUIRED_FIELD`, `MISSING_QUERY_PARAM`, `MISSING_CALLBACK_ID`, `MISSING_SLIDES_ARRAY`, `MISSING_PROMPT`, `MISSING_TEMPLATE_ID`, `MISSING_FILE_CONTENT`, `MISSING_SHARE_DETAILS`, `INVALID_TYPE`, `INVALID_DATA`, `INVALID_DATA_TYPE`, `INVALID_PAYLOAD`, `INVALID_REQUEST`, `API_REQUEST_FAILED`, or `FILE_UPLOAD_FAILED`.
- `401` — Caller did not present a valid Bearer token, or the token has expired. `error.code` is one of `UNAUTHORIZED`, `INVALID_API_KEY`, `EXPIRED_API_KEY`.
- `403` — Caller is authenticated but not allowed to perform this operation. `error.code` is `FORBIDDEN`.
- `422` — Request was well-formed but failed semantic validation. `error.code` is one of `INVALID_INPUT`, `UNPROCESSABLE_ENTITY`.
- `429` — Rate limit, usage limit, or gateway-level throttle exceeded. `error.code` is `TOO_MANY_REQUESTS` (gateway throttle), `RATE_LIMIT_EXCEEDED` (per-category), or `USAGE_LIMIT_EXCEEDED` (annual quota). Default limits (all configurable per company/key): - Gateway throttle (per API key) → `TOO_MANY_REQUESTS`: 10 requests/second sustained, 5 burst, 1,000 requests/day. - Per-company, per-category sliding 60-second window → `RATE_LIMIT_EXCEEDED`. The applicable category is given by each operation's `x-rate-limit-category`. - Annual usage quota → `USAGE_LIMIT_EXCEEDED`: 50,000 slide generations/year and 1,000,000 presentation downloads/year. `X-RateLimit-Limit`/`X-RateLimit-Remaining`/`X-RateLimit-Reset` are returned on successful (2xx) responses from rate-limited endpoints and, with `Retry-After`, on the per-category `RATE_LIMIT_EXCEEDED` 429 (the headers declared below). The gateway `TOO_MANY_REQUESTS` and annual `USAGE_LIMIT_EXCEEDED` responses do not carry them. Read `X-RateLimit-Remaining` to self-throttle and honour `Retry-After` on a 429.
- `500` — Unexpected server error. `error.code` is `INTERNAL_SERVER_ERROR`.
- `503` — Service is temporarily unavailable (downstream dependency unhealthy). `error.code` is `SERVICE_UNAVAILABLE` or `EXTERNAL_SERVICE_ERROR`.
- `504` — A downstream call timed out. `error.code` is `GATEWAY_TIMEOUT`.

---

[API](https://skmtc.net/prezent/apis/prezent-platform-api.md) · [All operations](https://skmtc.net/prezent/apis/prezent-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/prezent/prezent-platform-api/revisions/a01cb764a085/schema)