> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expys.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register an outbound webhook endpoint (secret returned once)



## OpenAPI

````yaml /api-reference/openapi.json post /v1/webhooks
openapi: 3.0.3
info:
  description: Public REST API for embedding Expys experiences into a client app.
  title: Expys API
  version: 1.2.0
servers:
  - url: https://api.expys.com
    description: >-
      Expys API. Sandbox and live share this host; the environment is selected
      by which key you exchange for a member token, not by the URL.
security: []
paths:
  /v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Register an outbound webhook endpoint (secret returned once)
      operationId: createWebhook
      parameters:
        - description: >-
            Optional client-generated key (<=255 chars). A retried POST carrying
            the same key replays the original response instead of acting twice;
            reusing a key with a different body returns 409.
          in: header
          name: Idempotency-Key
          required: false
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointWithSecret'
          description: Response for status 201
          headers:
            X-Request-Id:
              description: >-
                Per-request correlation id. Quote it to support to trace the
                call in the server logs.
              schema:
                type: string
        '401':
          description: Authentication is missing or invalid.
          headers:
            X-Request-Id:
              description: >-
                Per-request correlation id. Quote it to support to trace the
                call in the server logs.
              schema:
                type: string
        '403':
          description: Authenticated, but not permitted to access this resource.
          headers:
            X-Request-Id:
              description: >-
                Per-request correlation id. Quote it to support to trace the
                call in the server logs.
              schema:
                type: string
        '429':
          description: Rate limit exceeded; honor the Retry-After header.
          headers:
            X-Request-Id:
              description: >-
                Per-request correlation id. Quote it to support to trace the
                call in the server logs.
              schema:
                type: string
        '500':
          description: An unexpected server error occurred.
          headers:
            X-Request-Id:
              description: >-
                Per-request correlation id. Quote it to support to trace the
                call in the server logs.
              schema:
                type: string
      security:
        - ApiKeyBearer: []
        - ApiKeyHeader: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: |-
            curl -X POST https://api.expys.com/v1/webhooks \
              -H "Authorization: Bearer YOUR_ORG_API_KEY" \
              -H "Content-Type: application/json" \
              -d '{
                "events": [
                  "string"
                ],
                "url": "string"
              }'
components:
  schemas:
    CreateWebhookRequest:
      properties:
        events:
          items:
            type: string
          type: array
        url:
          format: uri
          type: string
      required:
        - events
        - url
      type: object
    WebhookEndpointWithSecret:
      properties:
        createdAt:
          type: string
        environment:
          enum:
            - SANDBOX
            - LIVE
          type: string
        events:
          items:
            type: string
          type: array
        id:
          type: string
        signingSecret:
          type: string
        url:
          type: string
      required:
        - createdAt
        - environment
        - events
        - id
        - signingSecret
        - url
      type: object
  securitySchemes:
    ApiKeyBearer:
      description: Org-API-Key as a Bearer token.
      scheme: bearer
      type: http
    ApiKeyHeader:
      description: Org-API-Key as a header.
      in: header
      name: x-api-key
      type: apiKey

````