Skip to navigation
APIWebhooks

Create webhook

Creates a webhook endpoint. The response carries the signing secret, which is never returned again. The URL must be an absolute https address that resolves to a public host; credentials in the URL and private or loopback addresses are rejected with 400.

Requires the webhooks:write scope. Rate limit: 200 requests per minute per key (the api lane).

Authentication

AuthorizationBearer

Bearer token. Use ss_live_… for live data or ss_test_… for the sandbox (test mode). See Authentication.

Headers

SpreadSpace-VersionstringOptionalformat: "^\d{4}-\d{2}-\d{2}$"

Pin the API version, e.g. 2026-10-07. Omit to get the latest. See Versioning.

Request

This endpoint expects an object.
urlstringRequired

Absolute https URL that resolves to a public address. Credentials in the URL, private or loopback addresses, and unresolvable hosts are rejected with 400.

subscribed_eventslist of enumsRequired
descriptionstring or nullOptional<=256 characters
At most 256 characters.

Response headers

X-Request-IDstringOptional
Correlation ID for this request. Quote it in support tickets.
SpreadSpace-VersionstringOptional

The API surface version the server resolved for this request. Always present, regardless of whether the client supplied the request-side SpreadSpace-Version header. Default: 2026-10-07.

RateLimit-Limitinteger

Request budget of the endpoint’s rate-limit policy per 60-second sliding window. See Rate limits.

RateLimit-Remaininginteger

Requests left in the current window. Suppressed on 429 responses produced outside the rate limiter (for example a usage throttle), where a remaining budget would be misleading.

RateLimit-Resetinteger

Seconds until a guaranteed-fresh window.

RateLimit-PolicystringOptional

The active policy in limit;w=window-seconds form.

LocationstringOptional
The new endpoint's URL.

Response

Created
idstringformat: "uuid"
urlstring
statusenum
Allowed values:
subscribed_eventslist of enums
signing_secretstring

The plaintext signing secret. Returned exactly once at creation; the server never re-emits it. The admin must capture it now or rotate.

created_atdatetime
descriptionstring or nullOptional

Errors

400
Bad Request Error
401
Unauthorized Error
402
Payment Required Error
403
Forbidden Error
404
Not Found Error
429
Too Many Requests Error
500
Internal Server Error