Create webhook endpoint

Endpoint: POST /api/v1/webhooks

Availability: Live in production.

Authentication: API key in Authorization: Bearer <key> with the write scope.

Register a new webhook endpoint. The URL must use HTTPS and must resolve to a public IP address; URLs pointing to private IP ranges (RFC 1918), loopback addresses, or link-local addresses are rejected to prevent SSRF attacks.

The secret is returned only once, on creation. Deliveries are signed with X-Backwork-Signature.

Event types: compliance.acknowledged, * (all events).

Requires a plan with webhooks and an API key with write scope.

Parameters

• url (body, required): HTTPS URL that resolves to a public IP address
• events (body, required): Event types to subscribe to: compliance.acknowledged, * (all events)

Example request

curl -X POST "https://backworkhealth.com/api/v1/webhooks" \
  -H "Authorization: Bearer $BACKWORK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://your-app.com/webhooks/backwork",
  "events": [
    "compliance.acknowledged"
  ]
}'

Example response (201)

{
  "success": true,
  "data": {
    "id": 0,
    "url": "string",
    "events": [
      "string"
    ],
    "status": "string",
    "secret": "string",
    "created_at": "2026-01-15T10:30:00Z"
  },
  "meta": {
    "request_id": "string",
    "timestamp": "2026-01-15T10:30:00Z"
  }
}

curl -X POST "https://example.com/webhooks" \  -H "Content-Type: application/json" \  -d '{    "url": "https://your-app.com/webhooks/backwork",    "events": [      "compliance.acknowledged"    ]  }'

{  "success": true,  "data": {    "id": 0,    "url": "string",    "events": [      "string"    ],    "status": "string",    "secret": "string",    "created_at": "2019-08-24T14:15:22Z"  },  "meta": {    "request_id": "string",    "timestamp": "2019-08-24T14:15:22Z"  }}

Last updated on