Skip to main content
POST
Create a webhook endpoint

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

Idempotency-Key
string

Client-generated idempotency key (≤255 chars). Replays the cached response when the same (team, key) pair sees an identical request body within 24h; returns 409 idempotency_key_reused if the body differs. Recommended for every billable POST.

Maximum string length: 255
Autousers-Version
string

Date-pinned API version (e.g. 2026-05-04). Omit to receive the latest stable version. Behaves like Stripe's Stripe-Version — pinning a version freezes payload shapes against breaking changes during the 12-month sunset window.

Body

application/json
url
string<uri>
required

https:// only — non-TLS URLs are rejected

enabled_events
string[]
required

Allowlisted event names from the published catalog (e.g. evaluation.completed) or the wildcard "*" to subscribe to every type.

Required array length: 1 - 50 elements
description
string
Maximum string length: 500
api_version
string

Pin the endpoint to a specific event-payload version. Omit to receive the current version.

Maximum string length: 32

Response

Created — secret returned ONCE

id
string
required
url
string<uri>
required
secret
string
required

Plaintext signing secret (whsec_*). Returned ONCE on create / rotate-secret and never again — persist immediately or call rotate-secret to mint a new one.

secret_prefix
string
required
description
string | null
enabled_events
string[]
status
enum<string>
Available options:
enabled,
disabled
api_version
string | null
created_at
string<date-time>
updated_at
string<date-time>
{key}
any