---
title: "Create a webhook"
method: POST
path: "/v1/webhooks"
tags: ["Webhooks"]
---

# Create a webhook

`POST /v1/webhooks`

Creates a webhook. The response includes `signing_secret` — the only time it is ever returned — which you use to verify the `X-TestingBot-Signature` header on deliveries. A team may have at most 5 webhooks.

## Request body

- PostV1Webhooks — Create a webhook
  - `url` string, required — Destination URL. Must be a public http(s) address; private, loopback and link-local hosts are rejected.
  - `name` string — Label for the webhook. Required once the extended webhook columns are present.
  - `http_method` 'POST' | 'PUT' | 'PATCH' — HTTP method used to deliver. Defaults to POST.
  - `failure_only` boolean — Deliver only for failed tests. Defaults to false.
  - `alert_types` 'ALL' | 'VIRTUAL' | 'REAL' — Which grid to report on: ALL, VIRTUAL or REAL.
  - `name_filter` string — Glob matched against the test name, falling back to the build identifier.
  - `auth_type` 'NONE' | 'BASIC' | 'BEARER' — How to authenticate against your endpoint: NONE, BASIC or BEARER.
  - `auth_username` string — Username for BASIC auth. Write-only, never returned.
  - `auth_password` string — Password for BASIC auth. Write-only, never returned.
  - `auth_token` string — Token for BEARER auth. Write-only, never returned.
  - `headers` string[] — Custom request headers, each an object with `key` and `value`.
  - `params` string[] — Custom query parameters appended to the URL, each an object with `key` and `value`.
  - `payload_template` string — Custom JSON body template using `{{VARIABLES}}`. Omit to send the default TestingBot payload.

## Response `201`

Create a webhook

- TestingbotEntitiesWebhook — Testingbot_Entities_Webhook model
  - `id` integer, required — Unique numeric webhook ID.
  - `name` string, required — Label for the webhook, shown on the dashboard.
  - `url` string, required — Destination URL. May contain `{{VARIABLES}}`, which are substituted at delivery time.
  - `http_method` string, required — HTTP method used to deliver: POST, PUT or PATCH.
  - `failure_only` boolean, required — When true, only failed tests trigger a delivery.
  - `alert_types` string, required — Which grid the test ran on: ALL, VIRTUAL (VM) or REAL (physical device).
  - `name_filter` string, required — Glob matched against the test name, falling back to the build identifier. Empty means every test.
  - `auth_type` string, required — How the request authenticates against your endpoint: NONE, BASIC or BEARER. The credentials themselves are never returned.
  - `headers` object[], required — Custom request headers, each `{ "key": ..., "value": ... }`. Values support `{{VARIABLES}}`.
  - `params` object[], required — Custom query parameters appended to the URL, each `{ "key": ..., "value": ... }`.
  - `payload_template` string, required — Custom JSON body template. Empty means the default TestingBot payload is sent.
  - `created_at` string, date-time, required — When the webhook was created.
  - `updated_at` string, date-time, required — When the webhook was last changed.
  - `signing_secret` string, required — Secret used to verify the `X-TestingBot-Signature` header. Only present when the webhook is created or its secret is rotated; store it then, because it is never returned again.

## Other responses

- `401` — Authentication required
- `403` — Your role does not permit this action
- `422` — Validation error, unsafe URL, or webhook limit reached

---

[API](https://skmtc.net/testingbot/apis/testingbot-rest-api.md) · [All operations](https://skmtc.net/testingbot/apis/testingbot-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/testingbot/testingbot-rest-api/versions/eff607a49246/schema)