Create a webhook

Create a webhook endpoint. The secret is returned once in the response. Max 20 webhooks per org.

POST/api/webhooks

Authorization

better-auth.session_token<token>

Cookie session from Better Auth. Requires X-Org-Id header for org-scoped routes.

In: cookie

Header Parameters

X-Org-Id?string

Organization ID. Required for cookie auth. Not needed for API key auth (org resolved from key).

Formatuuid

Idempotency-Key?string

Unique key for idempotent requests (max 255 chars). Prevents duplicate resource creation on retries. Cached for 24 hours.

Lengthlength <= 255

Request Body

application/json

scope?string

Webhook scope. 'organization' fires for all runs; 'application' fires only for runs via the linked application's API key

Default"application"

Value in"organization" | "application"

applicationId?string

Application ID (app_ prefix). Required when scope is 'application'

url*string

HTTPS endpoint URL

Formaturi

events*array<>

Event types to subscribe to

packageId?|

Filter by agent ID (null = all agents)

payloadMode?string

Payload mode: full includes result/input, summary omits them

Default"full"

Value in"full" | "summary"

active?boolean

Defaulttrue

curl -X POST "https://loading/api/webhooks" \  -H "Content-Type: application/json" \  -d '{    "url": "http://example.com",    "events": [      "run.started"    ]  }'

{
  "id": "string",
  "object": "webhook",
  "scope": "organization",
  "applicationId": "string",
  "url": "http://example.com",
  "events": [
    "string"
  ],
  "packageId": "string",
  "payloadMode": "full",
  "active": true,
  "createdAt": "2019-08-24T14:15:22Z",
  "secret": "string"
}

{
  "type": "https://docs.appstrate.dev/errors/invalid-request",
  "title": "Invalid Request",
  "status": 400,
  "detail": "Field is required",
  "code": "invalid_request",
  "requestId": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid or missing session",
  "code": "unauthorized",
  "requestId": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "Insufficient permissions",
  "code": "forbidden",
  "requestId": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/idempotency-in-progress",
  "title": "Idempotency In Progress",
  "status": 409,
  "detail": "A request with the same Idempotency-Key is already being processed. Please wait and retry.",
  "code": "idempotency_in_progress",
  "requestId": "req_abc123"
}

{
  "type": "https://docs.appstrate.dev/errors/idempotency-conflict",
  "title": "Idempotency Conflict",
  "status": 422,
  "detail": "This Idempotency-Key was already used with a different request body. Use a new key for different requests.",
  "code": "idempotency_conflict",
  "requestId": "req_abc123"
}