createWebhookEndpoint

Requires permission settings:webhooks:create.

Creates a webhook endpoint with a name, a receiver URL and the events it subscribes to. The URL must use https in production, and at least one known event type is required. The response carries the signing secret, and it is the only time besides rotateWebhookEndpointSecret that the secret is returned, so store it. Requires permission to create webhooks.

Errors: a failed call returns a GraphQL errors entry, not a field on the result, and data may be null or partial. Read the entry's extensions.code and message; every shape and code is in the Error reference.

Example:

GraphQL

mutation CreateWebhookEndpoint($input: WebhookEndpointInput!) {
  createWebhookEndpoint(input: $input) {
    secret
    endpoint {
      id
      name
      createdAt
      eventTypes
      isActive
      secretHint
    }
  }
}

cURL

curl -X POST "https://<api-host>/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data @- <<'EOF'
{
  "query": "mutation CreateWebhookEndpoint($input: WebhookEndpointInput!) {\n  createWebhookEndpoint(input: $input) {\n    secret\n    endpoint {\n      id\n      name\n      createdAt\n      eventTypes\n      isActive\n      secretHint\n    }\n  }\n}",
  "variables": {
    "input": {
      "eventTypes": [
        "string"
      ],
      "name": "string",
      "url": "string"
    }
  }
}
EOF

Variables:

{
  "input": {
    "eventTypes": [
      "string"
    ],
    "name": "string",
    "url": "string"
  }
}

Response:

{
  "data": {
    "createWebhookEndpoint": {
      "secret": "string",
      "endpoint": {
        "id": "id",
        "name": "string",
        "createdAt": "2025-01-15T00:00:00Z",
        "eventTypes": [
          "string"
        ],
        "isActive": true,
        "secretHint": "string"
      }
    }
  }
}

createWebhookEndpoint(
  input: WebhookEndpointInput!
): WebhookEndpointWithSecret!

Arguments

createWebhookEndpoint.input ● WebhookEndpointInput! non-null input

The endpoint's name, receiver URL, subscribed event types and whether it is active.

Type

WebhookEndpointWithSecret object

A webhook endpoint with its signing secret. It is returned only when the endpoint is created or its secret is rotated, and cannot be read again.