---
title: "Create subscription"
method: POST
path: "/webhooks"
tags: ["14. Webhooks"]
---

# Create subscription

`POST /webhooks`

## Request body

- WebhookSubscriptionRequestView — The webhook subscription request.
  - `url` string, required — The URL of the customer's webhook listener. Must be a valid URL.
  - `headers` SubscriptionHeaderView[] — Appropriate for the authentication method the customer wants Tango to use when calling their webhook listener.
    - `name` string, required — The name of the header.
    - `value` string, required — The value of the header.
  - `categories` string[] — The categories the customer wants to subscribe to. Optional if specifying eventTypes.
  - `eventTypes` string[] — The event types the customer wants to subscribe to. Optional if specifying categories.
  - `signingCertificate` string — The public X509 certificate used to sign the webhook payload. Required when payloadVerificationMethod is X509. The certificate must be base64 encoded.
  - `hmacSharedSecretKey` string — The HMAC secret key used to sign the webhook payload. Required when payloadVerificationMethod is HMAC. The key must be base64 encoded.
  - `payloadVerificationMethod` 'HMAC' | 'X509' | 'NONE' — Method to verify webhook payload authenticity

## Response `201`

Created

- WebhookSubscriptionResponseView — The response from creating a webhook subscription.
  - `webhookId` string, uuid — The ID of the webhook.
  - `expiresAt` string, date-time — The date and time the webhook expires.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/tangocard/apis/tango-api.md) · [All operations](https://skmtc.net/tangocard/apis/tango-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tangocard/tango-api/revisions/324ad9683921/schema)