# Create a webhook

Creates a webhook that delivers the subscribed activity events to a public HTTPS endpoint, and returns it. The signing secret appears only in this response. Every filter must name a known event code, and the endpoint must resolve to a public HTTPS URL.

## POST `/v1/webhooks`

### Authorization

#### `Authorization` Bearer token · header required

`Authorization: Bearer <token>` with an API key (`sfa_` prefix), an OAuth access token, a session token, or a Space machine credential (`sfm_` prefix).

or

#### `Authorization` OAuth2 access token · header required

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

Scopes: `spaces:write`

### Request body

required `application/json`

- `teamId` string  
  Team that owns the webhook. Omit when the credential reaches exactly one team.  
  min length 1

- `url` string<uri> required  
  Public HTTPS endpoint that receives each event. Loopback and private-network hosts are rejected.

- `events` string[]  
  Activity event filters to subscribe to: exact codes, a prefix wildcard such as `version.*`, or `*` for every event.  
  min items 1 · default: `["*"]`

### Responses

#### 201 Response for status 201

- `$schema` string<uri>  
  Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `data` object required  
  Show properties Hide properties  
  - `id` string required  
  - `url` string<uri> required  
  - `events` string[] required  
    Event filters this webhook is subscribed to.  
  - `status` string required
    
    `active` delivers. `failing` follows 8 consecutive failures and still delivers. `disabled` follows 32 and stops. `deleted` is kept for audit only. Any success resets the count.
    
    Allowed: `active`, `disabled`, `failing`, `deleted`
    
  - `secret` string  
    Signing secret, present only in the response that created the webhook or rotated its secret. Store it then; it cannot be read back.
    
  - `secretPreview` string required  
    First eight and last four characters of the current signing secret.

- `previousSecretExpiresAt` string<date-time> | any required  
    ISO 8601 timestamp when the secret replaced by the last rotation stops being accepted. Null when no earlier secret is still valid.

Show properties Hide properties

Any of:

- string<date-time>
  - `string<date-time>`
  - any

- `createdAt` string<date-time> required
  - `updatedAt` string<date-time> required

### default Error

Every 4xx and 5xx response is one RFC 9457 problem document served as `application/problem+json`.

- `$schema` string<uri>  
  Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `type` string required  
  URL of the documentation page for this error. Derived from `code`.

- `title` string required  
  Human-readable name of the error type. Derived from `code`.

- `status` integer required  
  HTTP status of the response, repeated in the body.  
  min -9007199254740991 · max 9007199254740991

- `detail` string required  
  What went wrong in this request.

- `code` string required  
  Stable snake_case error code. Match on this, not on `detail`.

- `pointer` string  
  RFC 6901 JSON Pointer to the request field or batch entry that failed, for example `/files/37/path`. Present on validation failures.

- `details` object  
  Machine-readable context keyed by the error code.

- `suggestions` string[]  
  Recovery steps safe to show to a person.

- `next` string[]  
  Commands or API requests to run next, usable as written.

- `requestId` string required  
  ID of this request, from the `X-Request-Id` header or generated. Quote it when contacting support.

### Try it

#### Server

Base URL: https://api.spacefast.com  
Custom base URL: Overrides the selected server when set.

#### Authorization

Bearer token Remember on this device  
Include my values in samples

### Body application/json

### Request body

### Send

### Request

#### cURL

```bash
curl -X POST "https://api.spacefast.com/v1/webhooks" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{\n  "teamId": "string",\n  "url": "http://example.com",\n  "events": [\
    "*"\
  ]\n}'
```

#### JavaScript

```javascript
const response = await fetch("https://api.spacefast.com/v1/webhooks", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"teamId\": \"string\",\n  \"url\": \"http://example.com\",\n  \"events\": [\n    \"*\"\n  ]\n}"
});
```

#### Python

```python
import requests

response = requests.post(
    "https://api.spacefast.com/v1/webhooks",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"teamId\": \"string\",\n  \"url\": \"http://example.com\",\n  \"events\": [\n    \"*\"\n  ]\n}",
)
```

### Response

#### 201 default

```json
{
  "$schema": "http://example.com",
  "data": {
    "id": "string",
    "url": "http://example.com",
    "events": [\
      "string"\
    ],
    "status": "active",
    "secret": "string",
    "secretPreview": "string",
    "previousSecretExpiresAt": "2019-08-24T14:15:22Z",
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}
```

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [\
    "string"\
  ],
  "next": [\
    "string"\
  ],
  "requestId": "string"
}
```