Create Webhook Endpoint
Registers an https endpoint to receive signed event deliveries. The signing secret is returned once, in the response, and never again.
Required scope: webhooks:manage
Error Codes:
- DEVELOPER.SCOPE_INSUFFICIENT: The key lacks the webhooks:manage scope.
- INVALID_ARGUMENT: The url is not https, or an event type is unknown.
Authorizations
Body
Event types to deliver. Employee/person: employee.changed, employee.deleted, person.changed — a change to identity fields (name, IIN) emits ONLY person.changed (subscribe to it to receive renames), while employee.changed covers employment attributes (department, position, status). Document lifecycle: document.sent, document.approval_started, document.signing_started, document.completed, document.rejected, document.revoked, document.change_requested, document.deleted. Employee/person payloads carry {employee_id}; document payloads carry {document_id}. Refetch the resource with your own key. Note: document events are delivered for every document in the tenant regardless of the endpoint owner's per-document permissions — payloads reveal a document's id and lifecycle timing (never its content; GetDocument still enforces access). Do not subscribe if the mere existence or timing of confidential documents must stay hidden from the endpoint owner.
Delivery target. Must be https. A host that resolves to a private or loopback address is accepted here but blocked at delivery time, so every attempt would fail.