> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exowizz.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a subscription

> Creates a new webhook subscription.

Creates a webhook subscription that delivers events to the specified URL. The full secret is only returned in this response.

## Request body

<ParamField body="url" type="string" required>
  The URL to receive webhook POST requests. Must be a valid URL (max 2048 characters).
</ParamField>

<ParamField body="resource" type="string" required>
  The resource name to subscribe to. Must match a registered resource.
</ParamField>

<ParamField body="events" type="array" required>
  Array of trigger events to listen for. Must be a subset of the resource's supported triggers: `on_create`, `on_update`, `on_delete`.
</ParamField>

## Request

```bash theme={null}
curl -X POST \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "url": "https://example.com/webhook-receiver",
       "resource": "order",
       "events": ["on_create", "on_update"]
     }' \
     https://your-app.com/exo-api/webhooks
```

## Response

Returns the created subscription with a `201 Created` status. The `secret` field contains the full webhook secret.

**Example response:**

```json theme={null}
{
  "id": 1,
  "user_id": 1,
  "url": "https://example.com/webhook-receiver",
  "resource": "order",
  "events": ["on_create", "on_update"],
  "secret": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2",
  "is_active": true,
  "created_at": "2026-03-28T14:30:00.000000Z",
  "updated_at": "2026-03-28T14:30:00.000000Z"
}
```

<Warning>
  The `secret` is only returned in full in this response. Store it securely — you need it to [verify webhook signatures](/webhooks/security). Subsequent requests show only a masked version.
</Warning>

## Errors

| Status | Description                                                              |
| ------ | ------------------------------------------------------------------------ |
| `422`  | Validation failed — invalid URL, unknown resource, or unsupported events |