# Create webhook

Endpoint: POST /hooks
Version: 2.0.53
Security: authJWT

## Request fields (application/json):

  - `name` (string, required)
    Human-readable name for this webhook
    Example: Stripe Payment Webhook

  - `description` (string)
    Optional description
    Example: Handles payment confirmations from Stripe

  - `targetUrl` (string, required)
    Target URL where requests will be forwarded
    Example: https://internal-api.example.com/payments/webhook

  - `isActive` (boolean)
    Whether webhook is active

  - `allowedMethods` (array)
    Allowed HTTP methods (defaults to POST only)
    Example: ["POST"]

  - `outboundAuthType` (string)
    Outbound authentication type
    Enum: "NONE", "BEARER", "JWT", "HMAC"

  - `outboundAuthCredentials` (string)
    Outbound authentication credentials (Bearer token)

  - `inboundAllowedSources` (array, required)
    Allowed inbound sources
    Example: ["STRIPE"]

  - `inboundSecret` (string)
    Secret for external source verification (e.g., Stripe signing secret)

  - `timeoutMs` (number)
    Request timeout in milliseconds

## Response 201 fields (application/json):

  - `id` (string, required)
    Webhook ID

  - `name` (string, required)
    Human-readable name

  - `description` (string)
    Optional description

  - `targetUrl` (string, required)
    Target URL where requests are forwarded

  - `url` (string, required)
    Public URL to receive webhook requests (format: {baseUrl}/{apiVersion}/hooks/{projectKey}/{hookId})
    Example: https://api.pers.ninja/v2/hooks/b3245237f5e658af.../550e8400-e29b-41d4-a716-446655440000

  - `isActive` (boolean, required)
    Whether webhook is active

  - `allowedMethods` (array, required)
    Allowed HTTP methods

  - `outboundAuthType` (string, required)
    Outbound authentication type
    Enum: "NONE", "BEARER", "JWT", "HMAC"

  - `hasOutboundCredentials` (boolean, required)
    Whether outbound credentials are configured

  - `inboundAllowedSources` (array, required)
    Allowed inbound sources

  - `hasInboundSecret` (boolean, required)
    Whether inbound secret is configured

  - `timeoutMs` (number, required)
    Request timeout in milliseconds

  - `createdAt` (string, required)
    Creation timestamp

  - `updatedAt` (string, required)
    Last update timestamp