Skip to main content
POST
Create Webhook Endpoint

Authorizations

Authorization
string
header
required

API key in the Authorization header: Bearer qr_live_… or Bearer qr_test_…. Token endpoints take a Clerk session JWT instead.

Body

application/json
url
string<uri>
required

HTTPS URL to receive event payloads. Must resolve to a publicly routable host.

Maximum string length: 2048
Example:

"https://example.com/webhooks/qrkit"

events
enum<string>[]
required

Event types to subscribe to. Use "*" to subscribe to all current and future event types.

Minimum array length: 1
Available options:
qr.created,
qr.updated,
qr.deleted,
qr.scanned,
batch.completed,
batch.failed,
*
description
string

Optional human-readable label for this endpoint.

Maximum string length: 500
source
enum<string>
default:api

Who manages this endpoint. Integration platforms (Zapier, Make, n8n) set their own value so their endpoints are counted and capped separately (10 per workspace for api, 50 for each integration source). Immutable after creation.

Available options:
api,
zapier,
make,
n8n

Response

Webhook endpoint created (full secret shown once)

id
string
Example:

"whe_aB3dE5fG7hI9jK1m"

object
string
Example:

"webhook_endpoint"

url
string<uri>
Example:

"https://example.com/webhooks/qrkit"

description
string | null
events
string[]
Example:
source
enum<string>

Who manages this endpoint. Set at creation, immutable afterwards. Endpoint caps are counted per source.

Available options:
api,
zapier,
make,
n8n
status
enum<string>

auto_disabled is set automatically after sustained delivery failures. Re-enable with PATCH /webhooks/{id} { "status": "enabled" }.

Available options:
enabled,
disabled,
auto_disabled
secret
string

Full whsec_… value returned only on create (POST /webhooks) and secret rotation (POST /webhooks/{id}/rotate-secret). All other reads return the masked form whsec_…XXXX.

Example:

"whsec_…a1b2"

last_success_at
string<date-time> | null
last_failure_at
string<date-time> | null
created_at
string<date-time>
updated_at
string<date-time>