Create Webhook Endpoint

POST /webhook-endpoints

Admin, not member: creating one opens a public URL into the workspace.

Role floor

Requires admin or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Request body — WebhookEndpointCreate

Field	Type		Notes
agent_id	string (uuid)	required	—
slug	string	required	min length 1 max length 100
http_method	POST | GET | PUT	optional	Default "POST".
verification	hmac_sha256 | shared_token | none	optional	Default "hmac_sha256".
secret	string | null	optional	min length 16 max length 400
prompt_template	string	required	min length 1
input_template	object | null	optional	—
session_key_template	string | null	optional	max length 400
persona_slug_template	string | null	optional	max length 400
subject_template	SubjectTemplate | null	optional	—
response_mode	async | sync | callback | ack	optional	Default "async".
response_path	string | null	optional	max length 400
callback_url	string | null	optional	max length 2000
event_kind	string | null	optional	max length 60
rate_limit_per_minute	integer	optional	Default 60. min 1 max 10000
coalescing	CoalescingConfig	optional	—
unverified_ack	boolean	optional	Default false.
is_active	boolean	optional	Default true.

Responses

Status	Description	Body
201	Successful Response	WebhookEndpointView
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/webhook-endpoints \
  -H "Authorization: Bearer $COBRE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "agent_id": "0190a2f4-0000-7000-8000-000000000000",
       "slug": "string",
       "prompt_template": "string"
     }'

Response — WebhookEndpointView

Field	Type		Notes
id	string (uuid)	required	—
agent_id	string (uuid)	required	—
slug	string	required	—
http_method	POST | GET | PUT	required	—
verification	hmac_sha256 | shared_token | none	required	—
secret_set	boolean	required	—
rotation_active	boolean	required	—
secret_overlap_until	string (date-time) | null	required, nullable	—
prompt_template	string	required	—
input_template	object | null	required, nullable	—
session_key_template	string | null	required, nullable	—
persona_slug_template	string | null	required, nullable	—
subject_template	object | null	required, nullable	—
response_mode	async | sync | callback | ack	required	—
response_path	string | null	required, nullable	—
callback_url	string | null	required, nullable	—
event_kind	string | null	required, nullable	—
rate_limit_per_minute	integer	required	—
coalescing	object	required	—
unverified_ack	boolean	required	—
call_count	integer	required	—
is_active	boolean	required	—
created_at	string (date-time)	required	—