> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Webhook Endpoint V1

> Register a durable webhook endpoint. Returns the signing secret exactly once on creation. Subsequent reads omit it…

<Warning>
  **Confirm your deployment before running this request.** This page describes an API contract;
  a published reference does not establish hosted availability. Check the dated
  [host report](/api-reference/hosts) and obtain your deployment URL and credentials.
  Replace the example host if your provisioned service uses a different URL.
</Warning>

Register a durable webhook endpoint.

Returns the signing secret exactly once on creation. Subsequent reads
omit it; if you lose it or want to roll a leaked secret, call
`POST /webhooks/&#123;id&#125;/rotate-secret` — it preserves the delivery
history and only changes the signing secret.

### Request body

`CreateWebhookEndpointRequest`

<ParamField body="url" type="string" required>
  Receiver URL. Must start with http\:// or https\://; ≤2048 chars.
</ParamField>

<ParamField body="events" type="string[]">
  Events to subscribe to. Either explicit names ('job.completed', 'job.failed') or '\*' for all.
</ParamField>

### Response

`WebhookEndpointWithSecret`

<ResponseField name="id" type="string" required />

<ResponseField name="url" type="string" required />

<ResponseField name="events" type="string[]" required />

<ResponseField name="is_active" type="boolean" required />

<ResponseField name="created_at" type="string" required />

<ResponseField name="updated_at" type="string" required />

<ResponseField name="secret" type="string" required>
  HMAC-SHA256 signing secret. Compare incoming X-Webhook-Signature against `HMAC(secret, f'&#123;t&#125;.&#123;body&#125;')`.
</ResponseField>

### Status codes

| Code | Meaning |
| - | - |
| `201` | Successful Response |
| `422` | Validation Error |

### Using this contract

Read the [source OpenAPI document](/spec/computer-use.json) for declared schemas and alternatives.
This page also includes documented corrections from the [spec overlays](https://github.com/stateset/docs/tree/main/spec/overlays).
Example IDs and values are illustrative; replace them with records from your workspace.

<RequestExample>
  ```bash cURL theme={null}
  curl --silent --show-error --fail-with-body --request POST \
    --url 'https://api.computer.stateset.app/api/v1/webhooks' \
    --header "X-API-Key: $STATESET_COMPUTER_USE_API_KEY" \
    --header 'Content-Type: application/json' \
    --data '{
    "url": "https://example.com/webhooks/stateset",
    "events": [
      "string"
    ]
  }'
  ```
</RequestExample>

<ResponseExample>
  ```json 201 theme={null}
  {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "url": "https://example.com/webhooks/stateset",
    "events": [
      "string"
    ],
    "is_active": true,
    "created_at": "2026-08-31T14:22:05Z",
    "updated_at": "2026-08-31T14:22:05Z",
    "secret": "YOUR_API_KEY"
  }
  ```
</ResponseExample>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.