Create endpoint

POST

/v1/endpoints

curl --request POST \
  --url https://api.hookbridge.io/v1/endpoints \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "url": "https://customer.app/webhooks" }'

• Production

Create a new webhook endpoint. The endpoint URL must be HTTPS and publicly accessible. A signing secret is automatically generated and returned only in this response.

Important: The signing_secret is only returned once. Store it securely for verifying webhook signatures.

Authorizations

• BearerAuth

Request Body^required

Media typeapplication/json

object

url

required

HTTPS URL of the webhook endpoint. Must be publicly accessible. Internal/private IP addresses are blocked for security.

string format: uri

>= 12 characters <= 2048 characters /^https:///

description

Optional description of the endpoint

string

<= 500 characters

rate_limit_rps

Rate limit in requests per second (0 = no limit)

integer

0 <= 1000

burst

Maximum burst size for rate limiting

integer

0 <= 10000

headers

Custom headers to include in webhook requests

object

key

additional properties

string

ephemeral

If true, creates an ephemeral endpoint for CI/test workflows. Ephemeral endpoints auto-expire after the TTL.

boolean

ttl_minutes

Time-to-live in minutes for ephemeral endpoints. Only used when ephemeral is true. After this duration, the endpoint is automatically deleted.

integer

default: 30 >= 1 <= 1440

Examples

Basic endpoint

{
  "url": "https://customer.app/webhooks"
}

Endpoint with rate limiting

{
  "url": "https://customer.app/webhooks",
  "description": "Main production webhook",
  "rate_limit_rps": 10,
  "burst": 20,
  "headers": {
    "X-Custom-Header": "value"
  }
}

Responses

201

Endpoint created successfully

Media typeapplication/json

object

data

object

id

Unique endpoint identifier

string

url

Webhook delivery URL

string format: uri

description

Optional description

string

signing_key_id

Initial signing key identifier

string

signing_secret

The signing secret - shown only once! Store this securely for verifying webhook signatures.

string

key_hint

Short identifier suffix for the initial signing key

string

ephemeral

Whether this is an ephemeral (CI/test) endpoint

boolean

expires_at

When the ephemeral endpoint will auto-expire (only present for ephemeral endpoints)

string format: date-time

created_at

When the endpoint was created

string format: date-time

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "data": {
    "id": "ep_550e8400e29b41d4a716446655440000",
    "url": "https://customer.app/webhooks",
    "description": "Main production webhook",
    "signing_key_id": "sk_550e8400e29b41d4a716446655440001",
    "signing_secret": "whsec_abcdefghijklmnopqrstuvwxyz123456",
    "key_hint": "abcd",
    "created_at": "2025-12-06T12:00:00Z"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

400

Invalid request

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}