Skip to main content
POST
Create Webhook
Register a URL to receive real-time event notifications. The HMAC signing secret is returned once in the response. Save it immediately — you can’t retrieve it later.

Authentication


Request body

url
string
required
HTTPS endpoint URL that will receive webhook POSTs.
events
string[]
required
Event types to subscribe to. At least one required.
name
string
required
User-friendly name for this webhook.
description
string
Optional description.

Response

id
string
Webhook ID
secret
string
HMAC-SHA256 signing secret. Shown once. Use this to verify X-Tuco-Signature on incoming webhooks.
url
string
Endpoint URL
events
string[]
Subscribed events
name
string
Webhook name
createdAt
string
Creation timestamp (ISO UTC)
warning
string
Reminder to save the secret

Examples

201 Response
Copy the secret from the response and store it securely (e.g. environment variable). This is the only time it’s returned. If you lose it, delete the webhook and create a new one.

Errors