Register a webhook endpoint. Requires webhooks:write.
The 201 body carries the HMAC signing secret — returned ONLY in this response,
once, at creation (the column is unreadable to clients afterwards; GET/PATCH can
never return it again). Store it immediately.
The URL must be a public https:// endpoint (an SSRF guard rejects localhost/
private/internal hosts with 422). Omit events to subscribe to ALL events; an
EXPLICIT events: [] is rejected with 422 (the empty set means “all”, which
makes an empty list ambiguous intent).
Authorizations
The access_token from the exchange endpoint.
Body
A public https:// URL (SSRF guard rejects localhost/private/internal hosts).
Event types to deliver (e.g. run.completed). OMIT to subscribe to ALL events; an explicit empty array is rejected with 422 (the empty set means "all", making [] ambiguous intent).
1Response
Webhook created. The secret in this body is shown exactly once.