Skip to main content
POST
/
v1
/
public
/
webhook
/
subscription
Create a subscription
curl --request POST \
  --url https://api.example.com/v1/public/webhook/subscription \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Payment Events Webhook",
  "description": "Receives payment events with custom authentication",
  "url": "https://api.example.com/webhooks/payments",
  "active": true,
  "enable_signed_webhooks": true,
  "events": [],
  "headers": {
    "X-Custom-Header": "custom-value",
    "Authorization": "Bearer your-api-token-here"
  }
}
'
{
  "id": "6a27a76692d9e3a8ffd7e62d",
  "organization_id": "ddd6f1d8-b232-497e-bf1e-ea7317622d17",
  "scope": "ORGANIZATION",
  "created_user_id": "google-oauth2|101090478854418701727",
  "name": "Payment Events Webhook",
  "url": "https://api.example.com/webhooks/payments",
  "events": [],
  "active": true,
  "headers": {
    "X-Custom-Header": "custom-value",
    "Authorization": "Bearer your-api-token-here"
  },
  "description": "Receives payment events with custom authentication",
  "request_timeout_ms": 1000,
  "retry_policy": {
    "retryStrategy": "FIXED_DELAY",
    "maxRetryAttempts": 3,
    "maxRetryDelayMs": 10000
  },
  "signing_enabled": true,
  "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "created_at": "2026-06-09T10:15:00.000Z",
  "updated_at": "2026-06-09T10:15:00.000Z"
}

Authorizations

​
Authorization
string
header
required

API key passed as a Bearer token in the Authorization header: Authorization: Bearer <YOUR_API_KEY>.

Body

application/json
​
name
string
required

Display name for the subscription (non-blank; unique per organization).

Example:

"Payment Events Webhook"

​
url
string
required

Destination endpoint that receives event POSTs. Must match ^https?://.*.

Pattern: ^https?://.*
Example:

"https://api.example.com/webhooks/payments"

​
active
boolean
required

Whether deliveries are attempted (true) or paused (false).

Example:

true

​
enable_signed_webhooks
boolean
required

HMAC signing toggle. Must be true or false (omitting it returns 400). On create, true generates a whsec_ signing secret returned once in the response; false creates an unsigned subscription. On update it also drives the signing lifecycle (enable or disable signing).

Example:

true

​
events
string[]

Event types to subscribe to, each in the case-sensitive Service.Event pattern (e.g. CallHandler.CallStarted). An empty array or ["*"] subscribes to all events.

Example:
[]
​
headers
Headers · object

Custom HTTP headers sent with each delivery (string->string map; e.g. auth tokens for your receiving endpoint).

Example:
{
  "X-Custom-Header": "custom-value",
  "Authorization": "Bearer your-api-token-here"
}
​
description
string

Free-text description (max 1500 chars).

Maximum string length: 1500
Example:

"Receives payment events with custom authentication"

​
agent_ids
string[]

Scope the subscription to specific agents (scope = AGENT).

​
workspace_ids
string[]

Scope the subscription to specific workspaces (scope = WORKSPACE).

Response

Created. Includes the one-time secret when signing is enabled.

​
id
string

Subscription ID. Required for GET / PUT / DELETE.

Example:

"6a27a76692d9e3a8ffd7e62d"

​
organization_id
string

Owning organization (resolved from your API key).

Example:

"ddd6f1d8-b232-497e-bf1e-ea7317622d17"

​
scope
enum<string>

Resolved delivery scope.

Available options:
ORGANIZATION,
WORKSPACE,
AGENT
Example:

"ORGANIZATION"

​
created_user_id
string

User that created the subscription.

Example:

"google-oauth2|101090478854418701727"

​
name
string
Example:

"Payment Events Webhook"

​
url
string
Example:

"https://api.example.com/webhooks/payments"

​
events
string[]
Example:
[]
​
active
boolean
Example:

true

​
headers
Headers · object

Custom HTTP headers forwarded with each delivery; omitted when unset.

Example:
{
  "X-Custom-Header": "custom-value",
  "Authorization": "Bearer your-api-token-here"
}
​
description
string

Free-text description; omitted when unset.

Example:

"Receives payment events with custom authentication"

​
agent_ids
string[]

Agent scope; omitted when unset.

​
workspace_ids
string[]

Workspace scope; omitted when unset.

​
request_timeout_ms
integer

Per-attempt delivery timeout in ms (default 1000).

Example:

1000

​
retry_policy
WebhookRetryPolicy · object

Delivery retry configuration.

​
signing_enabled
boolean

Whether the subscription has a signing secret. Always present.

Example:

true

​
secret
string

HMAC signing secret, prefixed whsec_. Present only at issuance when signing is enabled. Never returned by read endpoints.

Example:

"whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

​
created_at
string<date-time>
Example:

"2026-06-09T10:15:00.000Z"

​
updated_at
string<date-time>
Example:

"2026-06-09T10:15:00.000Z"