VoidhashDocs
DevelopersHelp centerGuidesAPI reference
Dashboard
Essentials
API overview
Authentication
Event capture
Push device API
Webhooks
Webhook delivery
Webhook events
Projects & keys
Projects
API keys
Audit log
Customers & access
Persons
Products
Perks
Sandbox
Paywalls
Paywalls
Paywall locations
Components
Component registry
Assets
Experiments & flags
Experiments
Feature flags
Analytics & events
Analytics
Analytics alerts
Events
Ingest policy
VoidQL
Tracking domains
Ads
Ads
Ad accounts
Meta measurement
Payments & stores
Payment providers
Payment provider products
Purchase history imports
Payment sources
Webhooks & notifications
Webhooks
Push notifications
Push configurations
Automations
Organization & team
Organizations
Members
Invitations
Billing
Your account
Profile
Session
Notices
Connected apps
Terms of Service
Developer tools
Schema
SDK
List webhooks
Create a webhook
Retrieve a webhook
Update a webhook
Delete a webhook
Rotate a webhook's secret
Send a test event
List a webhook's deliveries
Retrieve a webhook delivery
Retry a webhook delivery

Create a webhook

Creates a webhook and returns it with its signing secret.

This response is the only time the secret is shown; rotate it to get a new one.

Guide: Webhook delivery

POST
/api/v1/projects/{projectId}/webhooks

Authorization

AuthorizationBearer <token>

A project secret key: vh_sk_... for production, vh_sk_test_... for test. Keep it on your servers.

In: header

Path parameters

projectId*string

The project's id, proj_.... A secret key works only in the project it belongs to.

Request body

application/json

TypeScript definitions

Use the request body type in TypeScript.

name*string

What the webhook is for.

description?|

A longer note for the team.

url*string

The URL to POST events to, reachable from the internet: Voidhash does not call localhost or private networks.

events*array<>

The events the webhook receives; at least one.

Items1 <= items
environment?|

Whose purchase events it receives. Defaults to production; events of no purchase, such as a person's, reach both.

Examples

curl -X POST "https://api.voidhash.com/api/v1/projects/proj_tz4a98xxat96iws9zmbrgj3a/webhooks" \  -H "Authorization: Bearer vh_sk_..." \  -H "Content-Type: application/json" \  -d '{    "name": "Orders backend",    "url": "https://example.com/webhooks/voidhash",    "events": [      "subscription.created",      "subscription.renewed",      "purchase.refunded"    ],    "environment": "production"  }'
{  "id": "wh_ep_q5w8e2r7t1y4u9i3o6p0a2s5",  "projectId": "proj_tz4a98xxat96iws9zmbrgj3a",  "name": "Orders backend",  "description": null,  "url": "https://example.com/webhooks/voidhash",  "events": [    "subscription.created",    "subscription.renewed",    "purchase.refunded"  ],  "environment": "production",  "status": "active",  "consecutiveFailures": 0,  "lastSuccessAt": null,  "createdAt": "2026-03-01T10:00:00.000Z",  "secret": "whsec_..."}
{  "error": {    "type": "invalid_request",    "code": "invalid_webhook_url",    "message": "Webhook URL must point to a public address, not localhost or a private network",    "param": "url"  }}
{  "error": {    "type": "unauthenticated",    "code": "invalid_api_key",    "message": "This secret key is not valid."  }}
{  "error": {    "type": "permission_denied",    "code": "permission_denied",    "message": "Insufficient permissions."  }}
{  "error": {    "type": "not_found",    "code": "project_not_found",    "message": "There is no project proj_tz4a98xxat96iws9zmbrgj3a, or this credential cannot use it.",    "param": "projectId"  }}
{  "error": {    "type": "internal",    "code": "internal_error",    "message": "Something went wrong on our side. Try again, and contact support with the Request-Id header if it keeps failing."  }}

Response body

application/json

application/json

application/json

application/json

application/json

application/json

Errors

StatustypecodeWhen
400invalid_requestinvalid_webhook_urlFor a URL Voidhash cannot deliver to.

It can also fail with the errors every operation shares, such as unauthenticated; see Errors.

More in Webhooks

  • List webhooks GET
  • Retrieve a webhook GET
  • Update a webhook PATCH
  • Delete a webhook DELETE
  • Rotate a webhook's secret POST
  • Send a test event POST
  • List a webhook's deliveries GET
  • Retrieve a webhook delivery GET
  • Retry a webhook delivery POST

Something wrong or missing on this page? Tell us by email or on Discord.

PreviousList webhooksNextRetrieve a webhook

On this page

AuthorizationPath parametersRequest bodyExamplesResponse bodyErrorsMore in Webhooks