# Create a webhook endpoint

> POST /v1/webhooks. Register an https endpoint for events.

Source: https://emailmovers.com/mydatahub/docs/reference/rest/create-webhook-endpoint

`POST /v1/webhooks`

Register an https endpoint for events. Deliveries follow Standard Webhooks (webhook-id, webhook-timestamp, webhook-signature; HMAC-SHA256 with a whsec_ secret, shown once) and retry over 24 hours. The endpoint is pinned to the request's MyDataHub-Version.

| Property | Value |
| --- | --- |
| Endpoint | `POST https://mydatahub.emailmovers.com/v1/webhooks` |
| Operation id | `createWebhookEndpoint` |
| Cost | Free (0 credits) |
| Access | An API key or an OAuth 2.1 token with the scope `webhooks:write`. |
| Idempotency-Key | Optional. Makes a retry safe. |
| Tag | Webhooks |

> **Not yet live.** MyDataHub v2 is built and tested locally and is not yet live. The v2 hosts open at launch, date to confirm. This page describes the contract the API is tested against.

## Request

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `MyDataHub-Version` | header | string | no | The dated API version, pinned per key when left out. Non-breaking changes ship as new dates; the path major changes only for breaking changes, with a 12 month deprecation window. |
| `Idempotency-Key` | header | string | no | Makes the request safe to retry: the same key returns the stored response. Keys are kept for the life of the organisation. |

### Body

| Member | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | string (uri) | yes |  |
| `events` | array of enum: `order.ready`, `order.failed`, `audience.refreshed`, `credits.low`, `credits.topped_up`, `warranty.replacement_issued`, `suppression.created`, `push.completed`, and 3 more | yes |  |
| `description` | string | no |  |

## Example request

```bash
curl -X POST "https://mydatahub.emailmovers.com/v1/webhooks" \
  -H "Authorization: Bearer $MYDATAHUB_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
  "url": "https://agent.example.com/mydatahub/events",
  "events": ["order.ready", "credits.low", "suppression.created"],
  "description": "SDR agent"
}'
```

## Responses

### 201: The endpoint and its secret.

Headers: `RateLimit`, `RateLimit-Policy`, `Location`.

| Member | Type | Always present | Description |
| --- | --- | --- | --- |
| `endpoint` | `WebhookEndpoint` | yes | Where to deliver events, and which ones. |
| `endpoint.id` | string | yes | Format: a webhook endpoint id: whk_ followed by a 26 character ULID in upper case Crockford base32, such as whk_01JB3Y8Q2V7XN3M9R6T1Y5W8ZA. |
| `endpoint.url` | string (uri) | yes |  |
| `endpoint.events` | array of enum: `order.ready`, `order.failed`, `audience.refreshed`, `credits.low`, `credits.topped_up`, `warranty.replacement_issued`, `suppression.created`, `push.completed`, and 3 more | yes |  |
| `endpoint.api_version` | string | yes | Pinned when the endpoint is created. |
| `endpoint.status` | enum: `active`, `disabled` | yes |  |
| `endpoint.description` | string or null | yes |  |
| `endpoint.created_at` | string (date-time) | yes |  |
| `secret` | string | yes | The signing secret (whsec_), shown once. Rotate it from the app. |

#### Example response

```json
{
  "endpoint": {
    "id": "whk_01JB3Y8Q2V7XN3M9R6T1Y5W8ZA",
    "url": "https://agent.example.com/mydatahub/events",
    "events": ["order.ready", "credits.low", "suppression.created"],
    "api_version": "2027-01-15",
    "status": "active",
    "description": "SDR agent",
    "created_at": "2026-09-20T09:45:00Z"
  },
  "secret": "whsec_ExampleSecret0000000000000000000"
}
```

## Errors

Every error is a problem object with a `code` and a `next_step`. Every response carries the `RateLimit` and `RateLimit-Policy` headers; see [Rate limits](https://emailmovers.com/mydatahub/docs/rate-limits.md).

| Status | Problem codes | When |
| --- | --- | --- |
| 400 | [`invalid-request`](https://emailmovers.com/mydatahub/docs/errors/invalid-request.md), [`idempotency-key-required`](https://emailmovers.com/mydatahub/docs/errors/idempotency-key-required.md), [`unsupported-version`](https://emailmovers.com/mydatahub/docs/errors/unsupported-version.md) | The request could not be read, or an Idempotency-Key is missing. |
| 401 | [`authentication-required`](https://emailmovers.com/mydatahub/docs/errors/authentication-required.md), [`account-required`](https://emailmovers.com/mydatahub/docs/errors/account-required.md) | Sign in (OAuth) or send an API key (authentication-required), or create a free account for what the anonymous tier does not cover (account-required). |
| 403 | [`insufficient-scope`](https://emailmovers.com/mydatahub/docs/errors/insufficient-scope.md), [`confirmation-required`](https://emailmovers.com/mydatahub/docs/errors/confirmation-required.md), [`business-details-required`](https://emailmovers.com/mydatahub/docs/errors/business-details-required.md), [`licence-acceptance-required`](https://emailmovers.com/mydatahub/docs/errors/licence-acceptance-required.md), [`dpa-acceptance-required`](https://emailmovers.com/mydatahub/docs/errors/dpa-acceptance-required.md), [`agent-budget-exceeded`](https://emailmovers.com/mydatahub/docs/errors/agent-budget-exceeded.md) | The token lacks a scope (insufficient-scope, with required_scope and a WWW-Authenticate step-up challenge); no person confirmed the spend and no agent key covers it (confirmation-required, with an approval_url); an agent key's per-order cap or monthly budget does not cover it (agent-budget-exceeded); an account made by self-serve sign-up has not yet confirmed its business name and that it is a UK business, which its first order needs (business-details-required); the order needs the Data Licence and Sharing Agreement accepted at the version in force (licence-acceptance-required); or a suppression upload comes before the organisation has accepted the Article 28 data processing agreement in force (dpa-acceptance-required). Nothing is charged. |
| 409 | [`idempotency-key-reused`](https://emailmovers.com/mydatahub/docs/errors/idempotency-key-reused.md), [`quote-expired`](https://emailmovers.com/mydatahub/docs/errors/quote-expired.md), [`order-not-ready`](https://emailmovers.com/mydatahub/docs/errors/order-not-ready.md), [`order-not-cancellable`](https://emailmovers.com/mydatahub/docs/errors/order-not-cancellable.md) | An Idempotency-Key reused with different parameters, an expired machine quote, or an object in the wrong state. |
| 422 | [`validation-failed`](https://emailmovers.com/mydatahub/docs/errors/validation-failed.md), [`quote-required`](https://emailmovers.com/mydatahub/docs/errors/quote-required.md), [`dataset-unavailable`](https://emailmovers.com/mydatahub/docs/errors/dataset-unavailable.md) | The request is not valid. errors lists every problem with a JSON pointer and did_you_mean. |
| 429 | [`rate-limited`](https://emailmovers.com/mydatahub/docs/errors/rate-limited.md) | Too many requests. Wait for Retry-After. |
| Any other failure | [`internal-error`](https://emailmovers.com/mydatahub/docs/errors/internal-error.md), [`service-unavailable`](https://emailmovers.com/mydatahub/docs/errors/service-unavailable.md), [`tps-screen-expired`](https://emailmovers.com/mydatahub/docs/errors/tps-screen-expired.md) | Something failed on our side (500 internal-error) or the service is briefly unavailable (503 service-unavailable, with Retry-After). Nothing was charged; retry with the same Idempotency-Key. A count, sample, quote or order with telephone in play is also refused with 503 tps-screen-expired, with no Retry-After, while the dataset version's TPS and CTPS screen is more than 28 days old. |