Skip to main content
POST
/
exo-api
/
webhooks
Create a subscription
curl --request POST \
  --url https://api.example.com/exo-api/webhooks \
  --header 'Content-Type: application/json' \
  --data '
{
  "url": "<string>",
  "resource": "<string>",
  "events": [
    {}
  ]
}
'
Creates a webhook subscription that delivers events to the specified URL. The full secret is only returned in this response.

​
Request body

​
url
string
required
The URL to receive webhook POST requests. Must be a valid URL (max 2048 characters).
​
resource
string
required
The resource name to subscribe to. Must match a registered resource.
​
events
array
required
Array of trigger events to listen for. Must be a subset of the resource’s supported triggers: on_create, on_update, on_delete.

​
Request

curl -X POST \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "url": "https://example.com/webhook-receiver",
       "resource": "order",
       "events": ["on_create", "on_update"]
     }' \
     https://your-app.com/exo-api/webhooks

​
Response

Returns the created subscription with a 201 Created status. The secret field contains the full webhook secret. Example response: 
{
  "id": 1,
  "user_id": 1,
  "url": "https://example.com/webhook-receiver",
  "resource": "order",
  "events": ["on_create", "on_update"],
  "secret": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2",
  "is_active": true,
  "created_at": "2026-03-28T14:30:00.000000Z",
  "updated_at": "2026-03-28T14:30:00.000000Z"
}
The secret is only returned in full in this response. Store it securely — you need it to verify webhook signatures. Subsequent requests show only a masked version.

​
Errors

StatusDescription
422Validation failed — invalid URL, unknown resource, or unsupported events