Create a webhook subscription

POST

/api/v1/webhooks

Creates a webhook subscription for the active Application's current Environment from a url, an event_types array, and an optional description. Use ["*"] to subscribe to all events (current and future); the wildcard cannot be mixed with concrete types, and any unsupported event type returns 400. The response includes a freshly minted HMAC signing secret that is shown only once at creation — store it to verify delivery signatures. Requires the webhook.manage permission.

Authentication

Bearer TokenAuthorization Option A

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

API KeyX-API-Key Option B

API key for management-tier access. Never send alongside an Authorization header: a request carrying both is refused.

Request body

application/json

urlstring Required

event_typesstring[] Required

descriptionstring Optional

Responses

application/json

dataWebhookCreatedResponseDto*

application/json

errorApiErrorBodyDto*

application/json

errorApiErrorBodyDto*

application/json

errorApiErrorBodyDto*

Returned object

WebhookCreatedResponseDtoView all properties on this resource

Request

curl -X POST "https://auth.canopy-io.com/api/v1/webhooks" \
  -H "X-API-Key: $CANOPY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "string",
    "event_types": [
      "string"
    ],
    "description": "string"
  }'

Response

{
  "data": {
    "id": "string",
    "scope": "environment",
    "url": "string",
    "event_types": [
      "string"
    ],
    "description": "string",
    "is_active": false,
    "created_at": "2026-04-20T12:00:00.000Z",
    "secret": "string"
  }
}

GETList webhook subscriptions
GETList subscribable webhook event types
GETList delivery attempts for a webhook
GETGet a webhook subscription
PATCHUpdate a webhook subscription
DELETEDelete a webhook subscription

Was this page helpful?

Tell us how we can improve this guide.