# Create a webhook endpoint

Creates a new webhook endpoint to receive Dinie events. The HMAC
signing secret (secret) is returned only in this response — store it
securely to validate the signatures of received events. Use event patterns
like loan., customer., or * to subscribe to entire categories. Each endpoint
can subscribe to multiple event patterns.

Endpoint: POST /webhooks/endpoints
Version: 2026-03-01
Security: bearerAuth

## Header parameters:

  - `Idempotency-Key` (string)
    Unique string for idempotent POST requests. Cached for 24 hours.

## Request fields (application/json):

  - `url` (string, required)
    HTTPS URL to receive webhook deliveries
    Example: "https://partner.example.com/webhooks/dinie"

  - `events` (array)
    Event types to subscribe to. Supports wildcards  (e.g., loan.). Empty or omitted = all events.
    Example: ["customer.active","credit_offer.available","loan.*"]

  - `description` (string)
    Optional human-readable label
    Example: "Production webhook"

## Response 201 fields (application/json):

  - `id` (string, required)

  - `url` (string, required)

  - `events` (array, required)

  - `description` (string,null, required)

  - `status` (string, required)
    Enum: "active", "disabled"

  - `created_at` (string, required)

  - `updated_at` (string, required)

  - `secret` (string, required)
    HMAC signing secret (prefix whsec_). Store securely -- shown only once.
    Example: "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

## Response 400 fields (application/problem+json):

  - `type` (string, required)
    URI identifying the error type

  - `title` (string, required)
    Short, human-readable summary of the problem type

  - `status` (integer, required)
    HTTP status code

  - `detail` (string, required)
    Human-readable explanation specific to this occurrence

  - `instance` (string)
    URI identifying this specific occurrence

  - `code` (string)
    Machine-readable subtype code

  - `param` (string)
    The request parameter that caused the error

  - `errors` (array)
    Field-level validation errors

  - `errors.param` (string, required)

  - `errors.detail` (string, required)

  - `errors.code` (string)

## Response 401 fields (application/problem+json):

  - `type` (string, required)
    URI identifying the error type

  - `title` (string, required)
    Short, human-readable summary of the problem type

  - `status` (integer, required)
    HTTP status code

  - `detail` (string, required)
    Human-readable explanation specific to this occurrence

  - `instance` (string)
    URI identifying this specific occurrence

  - `code` (string)
    Machine-readable subtype code

  - `param` (string)
    The request parameter that caused the error

  - `errors` (array)
    Field-level validation errors

  - `errors.param` (string, required)

  - `errors.detail` (string, required)

  - `errors.code` (string)

## Response 422 fields (application/problem+json):

  - `type` (string, required)
    URI identifying the error type

  - `title` (string, required)
    Short, human-readable summary of the problem type

  - `status` (integer, required)
    HTTP status code

  - `detail` (string, required)
    Human-readable explanation specific to this occurrence

  - `instance` (string)
    URI identifying this specific occurrence

  - `code` (string)
    Machine-readable subtype code

  - `param` (string)
    The request parameter that caused the error

  - `errors` (array)
    Field-level validation errors

  - `errors.param` (string, required)

  - `errors.detail` (string, required)

  - `errors.code` (string)

## Response 429 fields (application/problem+json):

  - `type` (string, required)
    URI identifying the error type

  - `title` (string, required)
    Short, human-readable summary of the problem type

  - `status` (integer, required)
    HTTP status code

  - `detail` (string, required)
    Human-readable explanation specific to this occurrence

  - `instance` (string)
    URI identifying this specific occurrence

  - `code` (string)
    Machine-readable subtype code

  - `param` (string)
    The request parameter that caused the error

  - `errors` (array)
    Field-level validation errors

  - `errors.param` (string, required)

  - `errors.detail` (string, required)

  - `errors.code` (string)

## Response 500 fields (application/problem+json):

  - `type` (string, required)
    URI identifying the error type

  - `title` (string, required)
    Short, human-readable summary of the problem type

  - `status` (integer, required)
    HTTP status code

  - `detail` (string, required)
    Human-readable explanation specific to this occurrence

  - `instance` (string)
    URI identifying this specific occurrence

  - `code` (string)
    Machine-readable subtype code

  - `param` (string)
    The request parameter that caused the error

  - `errors` (array)
    Field-level validation errors

  - `errors.param` (string, required)

  - `errors.detail` (string, required)

  - `errors.code` (string)