Create Webhook Endpoint
Registers a new webhook endpoint. The signing secret (secret) is returned
only on this response and on rotate-secret — store it securely.
Requires the webhooks:write scope. Endpoint caps are counted per source:
10 for api (the default), 50 for each integration source.
Authorizations
API key in the Authorization header: Bearer qr_live_… or Bearer qr_test_…. Token endpoints take a Clerk session JWT instead.
Body
HTTPS URL to receive event payloads. Must resolve to a publicly routable host.
2048"https://example.com/webhooks/qrkit"
Event types to subscribe to. Use "*" to subscribe to all current and future event types.
1qr.created, qr.updated, qr.deleted, qr.scanned, batch.completed, batch.failed, * Optional human-readable label for this endpoint.
500Who manages this endpoint. Integration platforms (Zapier, Make, n8n) set their own value so their endpoints are counted and capped separately (10 per workspace for api, 50 for each integration source). Immutable after creation.
api, zapier, make, n8n Response
Webhook endpoint created (full secret shown once)
"whe_aB3dE5fG7hI9jK1m"
"webhook_endpoint"
"https://example.com/webhooks/qrkit"
Who manages this endpoint. Set at creation, immutable afterwards. Endpoint caps are counted per source.
api, zapier, make, n8n auto_disabled is set automatically after sustained delivery failures. Re-enable with PATCH /webhooks/{id} { "status": "enabled" }.
enabled, disabled, auto_disabled Full whsec_… value returned only on create (POST /webhooks) and secret rotation (POST /webhooks/{id}/rotate-secret). All other reads return the masked form whsec_…XXXX.
"whsec_…a1b2"

