Skip to main content
POST
/
api
/
v1
/
webhooks
Create a webhook endpoint
curl --request POST \
  --url https://app.autousers.ai/api/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "url": "<string>",
  "enabled_events": [
    "<string>"
  ],
  "description": "<string>",
  "api_version": "<string>"
}
'
{
  "id": "<string>",
  "url": "<string>",
  "secret": "<string>",
  "secret_prefix": "<string>",
  "description": "<string>",
  "enabled_events": [
    "<string>"
  ],
  "status": "enabled",
  "api_version": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z"
}

Documentation Index

Fetch the complete documentation index at: https://docs.autousers.ai/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

​
Idempotency-Key
string

Client-generated idempotency key (≤255 chars). Replays the cached response when the same (team, key) pair sees an identical request body within 24h; returns 409 idempotency_key_reused if the body differs. Recommended for every billable POST.

Maximum string length: 255
​
Autousers-Version
string

Date-pinned API version (e.g. 2026-05-04). Omit to receive the latest stable version. Behaves like Stripe's Stripe-Version — pinning a version freezes payload shapes against breaking changes during the 12-month sunset window.

Body

application/json
​
url
string<uri>
required

https:// only — non-TLS URLs are rejected

​
enabled_events
string[]
required

Allowlisted event names from the published catalog (e.g. evaluation.completed) or the wildcard "*" to subscribe to every type.

Required array length: 1 - 50 elements
​
description
string
Maximum string length: 500
​
api_version
string

Pin the endpoint to a specific event-payload version. Omit to receive the current version.

Maximum string length: 32

Response

Created — secret returned ONCE

​
id
string
required
​
url
string<uri>
required
​
secret
string
required

Plaintext signing secret (whsec_*). Returned ONCE on create / rotate-secret and never again — persist immediately or call rotate-secret to mint a new one.

​
secret_prefix
string
required
​
description
string | null
​
enabled_events
string[]
​
status
enum<string>
Available options:
enabled,
disabled
​
api_version
string | null
​
created_at
string<date-time>
​
updated_at
string<date-time>
​
{key}
any