---
title: "Create a webhook endpoint"
method: POST
path: "/webhooks"
tags: ["Webhooks"]
---

# Create a webhook endpoint

`POST /webhooks`

Creates a webhook endpoint. By default it is bound to the API key's derived scope (a personal key scopes to your user, a developer-app key to its game). Pass `leagueId` to create a league-scoped endpoint instead: you must be a current ADMIN of that league, and the league owner's plan must include the webhooks feature. Returns the signing secret ONCE. Requires the webhooks.manage permission and the webhooks feature.

## Request body

- CreateWebhookBody — Create a webhook endpoint in the caller's scope.
  - `url` string, required — HTTPS endpoint URL. Private/loopback/metadata hosts are rejected.
  - `events` string[], required — Subscribed event tokens: exact catalog names (e.g. match.completed) or family wildcards (e.g. match.*). At least one required.
  - `label` string — Optional human label for the endpoint.
  - `leagueId` string — League id - creates a league-scoped endpoint; requires current league ADMIN membership; gated on the league owner's plan.

## Response `201`

The created endpoint's id and one-time signing secret.

- WebhookSecret — One-time signing-secret reveal (create/rotate).
  - `id` string, required — The endpoint id the secret belongs to.
  - `signingSecret` string, required — Plaintext signing secret. Shown ONCE - store it now.
  - `secretPrefix` string, required — First 8 chars of the new signing secret.

## Other responses

- `400` — Bad request (invalid body, cursor, limit, or date).
- `401` — Missing or invalid API key.
- `403` — API key lacks the required permission.
- `404` — Resource not found.
- `409` — Conflict.
- `429` — Rate limited.

---

[API](https://skmtc.net/teambattles/apis/teambattles-api.md) · [All operations](https://skmtc.net/teambattles/apis/teambattles-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/teambattles/teambattles-api/revisions/2ffe8fb53b7d/schema)