> ## Documentation Index
> Fetch the complete documentation index at: https://developers.kit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook endpoint

> Registers a URL to receive deliveries for the [event types](/webhooks/event-types) listed in `events`. The `url` must be publicly reachable over HTTP(S) — private, internal, and loopback addresses are rejected.

**The response is the only time the signing `secret` is returned in plaintext.** Store it securely; you need it to [verify the signature](/webhooks/verifying-signatures) on every delivery. If you lose it, [rotate the secret](/api-reference/webhooks/rotate-a-webhook-endpoint-secret) to get a new one.

**Note:** This resource supersedes the [legacy Webhooks](/api-reference/webhooks-legacy/create-a-webhook) resource. Legacy webhooks keep working, but new integrations should be built here — see [getting started](/webhooks/getting-started) for a full walkthrough.



## OpenAPI

````yaml /api-reference/v4.json post /v4/webhook_endpoints
openapi: 3.0.3
info:
  title: Kit API
  version: '4.0'
servers:
  - url: https://api.kit.com
security: []
paths:
  /v4/webhook_endpoints:
    post:
      tags:
        - Webhooks
      summary: Create a webhook endpoint
      description: >-
        Registers a URL to receive deliveries for the [event
        types](/webhooks/event-types) listed in `events`. The `url` must be
        publicly reachable over HTTP(S) — private, internal, and loopback
        addresses are rejected.


        **The response is the only time the signing `secret` is returned in
        plaintext.** Store it securely; you need it to [verify the
        signature](/webhooks/verifying-signatures) on every delivery. If you
        lose it, [rotate the
        secret](/api-reference/webhooks/rotate-a-webhook-endpoint-secret) to get
        a new one.


        **Note:** This resource supersedes the [legacy
        Webhooks](/api-reference/webhooks-legacy/create-a-webhook) resource.
        Legacy webhooks keep working, but new integrations should be built here
        — see [getting started](/webhooks/getting-started) for a full
        walkthrough.
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                events:
                  type: array
                  items:
                    type: string
                  description: >-
                    Event types this endpoint subscribes to (e.g.
                    `subscriber.created`). On update, the list supplied here
                    replaces the endpoint's full subscription list.
                name:
                  type: string
                description:
                  type: string
              required:
                - url
                - events
            example:
              url: https://hooks.example.com/incoming
              events:
                - subscriber.created
                - custom_field.created
              name: My webhook
              description: Listens for things
      responses:
        '201':
          description: Creates a webhook endpoint
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhook_endpoint:
                    type: object
                    properties:
                      id:
                        type: integer
                      name:
                        type: string
                      url:
                        type: string
                      events:
                        type: array
                        items:
                          type: string
                      status:
                        type: string
                      source:
                        type: string
                      description:
                        type: string
                      created_by_app:
                        nullable: true
                      created_at:
                        type: string
                      previous_secret_expires_at:
                        nullable: true
                      secret:
                        type: string
                        description: >-
                          Signing secret used to verify webhook deliveries
                          (`whsec_` prefix). **Returned only in this response**
                          — store it securely; it cannot be retrieved again.
                    required:
                      - id
                      - name
                      - url
                      - events
                      - status
                      - source
                      - description
                      - created_by_app
                      - created_at
                      - previous_secret_expires_at
                      - secret
                required:
                  - webhook_endpoint
              example:
                webhook_endpoint:
                  id: 20
                  name: My webhook
                  url: https://hooks.example.com/incoming
                  events:
                    - custom_field.created
                    - subscriber.created
                  status: active
                  source: creator
                  description: Listens for things
                  created_by_app: null
                  created_at: '2023-02-17T11:43:55Z'
                  previous_secret_expires_at: null
                  secret: whsec_YOUR_SIGNING_SECRET_HERE
      security:
        - API Key: []
        - OAuth2: []
components:
  securitySchemes:
    API Key:
      description: Authenticate API requests via an API Key
      type: apiKey
      in: header
      name: X-Kit-Api-Key
    OAuth2:
      description: Authenticate API requests via an OAuth token
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.kit.com/v4/oauth/authorize
          tokenUrl: https://api.kit.com/v4/oauth/token
          refreshUrl: https://api.kit.com/v4/oauth/token
          scopes:
            read: Read access to Kit API v4
            write: Write access to Kit API v4

````

## Related topics

- [Create a webhook](/api-reference/webhooks-legacy/create-a-webhook.md)
- [Delete a webhook](/api-reference/webhooks-legacy/delete-a-webhook.md)
- [Get a webhook endpoint](/api-reference/webhooks/get-a-webhook-endpoint.md)
- [Webhooks overview](/webhooks/overview.md)
- [List webhook endpoints](/api-reference/webhooks/list-webhook-endpoints.md)