Reference

Create a webhook endpoint

POST /v1/webhooks. Register an https endpoint for events.

Generated from the contractsView as Markdown

POST /v1/webhooks

Register an https endpoint for events. Deliveries follow Standard Webhooks (webhook-id, webhook-timestamp, webhook-signature; HMAC-SHA256 with a whsec_ secret, shown once) and retry over 24 hours. The endpoint is pinned to the request's MyDataHub-Version.

Property	Value
Endpoint	`POST https://mydatahub.emailmovers.com/v1/webhooks`
Operation id	`createWebhookEndpoint`
Cost	Free (0 credits)
Access	An API key or an OAuth 2.1 token with the scope `webhooks:write`.
Idempotency-Key	Optional. Makes a retry safe.
Tag	Webhooks

Request

Parameters

Name	In	Type	Required	Description
`MyDataHub-Version`	header	string	no	The dated API version, pinned per key when left out. Non-breaking changes ship as new dates; the path major changes only for breaking changes, with a 12 month deprecation window.
`Idempotency-Key`	header	string	no	Makes the request safe to retry: the same key returns the stored response. Keys are kept for the life of the organisation.

Body

Member	Type	Required
`url`	string (uri)	yes
`events`	array of enum: `order.ready`, `order.failed`, `audience.refreshed`, `credits.low`, `credits.topped_up`, `warranty.replacement_issued`, `suppression.created`, `push.completed`, and 3 more	yes
`description`	string	no

Example request

curl -X POST "https://mydatahub.emailmovers.com/v1/webhooks" \
  -H "Authorization: Bearer $MYDATAHUB_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
  "url": "https://agent.example.com/mydatahub/events",
  "events": ["order.ready", "credits.low", "suppression.created"],
  "description": "SDR agent"
}'

Responses

201: The endpoint and its secret.

Headers: RateLimit, RateLimit-Policy, Location.

Member	Type	Always present	Description
`endpoint`	`WebhookEndpoint`	yes	Where to deliver events, and which ones.
`endpoint.id`	string	yes	Format: a webhook endpoint id: whk_ followed by a 26 character ULID in upper case Crockford base32, such as whk_01JB3Y8Q2V7XN3M9R6T1Y5W8ZA.
`endpoint.url`	string (uri)	yes
`endpoint.events`	array of enum: `order.ready`, `order.failed`, `audience.refreshed`, `credits.low`, `credits.topped_up`, `warranty.replacement_issued`, `suppression.created`, `push.completed`, and 3 more	yes
`endpoint.api_version`	string	yes	Pinned when the endpoint is created.
`endpoint.status`	enum: `active`, `disabled`	yes
`endpoint.description`	string or null	yes
`endpoint.created_at`	string (date-time)	yes
`secret`	string	yes	The signing secret (whsec_), shown once. Rotate it from the app.

Example response

{
  "endpoint": {
    "id": "whk_01JB3Y8Q2V7XN3M9R6T1Y5W8ZA",
    "url": "https://agent.example.com/mydatahub/events",
    "events": ["order.ready", "credits.low", "suppression.created"],
    "api_version": "2027-01-15",
    "status": "active",
    "description": "SDR agent",
    "created_at": "2026-09-20T09:45:00Z"
  },
  "secret": "whsec_ExampleSecret0000000000000000000"
}

Errors

Every error is a problem object with a code and a next_step. Every response carries the RateLimit and RateLimit-Policy headers; see Rate limits.

Status	Problem codes	When
400	`invalid-request`, `idempotency-key-required`, `unsupported-version`	The request could not be read, or an Idempotency-Key is missing.
401	`authentication-required`, `account-required`	Sign in (OAuth) or send an API key (authentication-required), or create a free account for what the anonymous tier does not cover (account-required).
403	`insufficient-scope`, `confirmation-required`, `business-details-required`, `licence-acceptance-required`, `dpa-acceptance-required`, `agent-budget-exceeded`	The token lacks a scope (insufficient-scope, with required_scope and a WWW-Authenticate step-up challenge); no person confirmed the spend and no agent key covers it (confirmation-required, with an approval_url); an agent key's per-order cap or monthly budget does not cover it (agent-budget-exceeded); an account made by self-serve sign-up has not yet confirmed its business name and that it is a UK business, which its first order needs (business-details-required); the order needs the Data Licence and Sharing Agreement accepted at the version in force (licence-acceptance-required); or a suppression upload comes before the organisation has accepted the Article 28 data processing agreement in force (dpa-acceptance-required). Nothing is charged.
409	`idempotency-key-reused`, `quote-expired`, `order-not-ready`, `order-not-cancellable`	An Idempotency-Key reused with different parameters, an expired machine quote, or an object in the wrong state.
422	`validation-failed`, `quote-required`, `dataset-unavailable`	The request is not valid. errors lists every problem with a JSON pointer and did_you_mean.
429	`rate-limited`	Too many requests. Wait for Retry-After.
Any other failure	`internal-error`, `service-unavailable`, `tps-screen-expired`	Something failed on our side (500 internal-error) or the service is briefly unavailable (503 service-unavailable, with Retry-After). Nothing was charged; retry with the same Idempotency-Key. A count, sample, quote or order with telephone in play is also refused with 503 tps-screen-expired, with no Retry-After, while the dataset version's TPS and CTPS screen is more than 28 days old.