# Create webhook endpoint
URL: https://backworkhealth.com/docs/api/createWebhook

Register a new webhook endpoint.

**Endpoint:** `POST /api/v1/webhooks`

**Availability:** Live in production.

**Authentication:** API key in `Authorization: Bearer <key>` with the `write` scope.

Register a new webhook endpoint. The URL must use HTTPS and must resolve to a public IP address; URLs pointing to private IP ranges (RFC 1918), loopback addresses, or link-local addresses are rejected to prevent SSRF attacks.

The secret is returned only once, on creation. Deliveries are signed with `X-Backwork-Signature`.

Event types: `compliance.acknowledged`, `*` (all events).

Requires a plan with webhooks and an API key with `write` scope.

**Parameters**

* `url` (body, required): HTTPS URL that resolves to a public IP address
* `events` (body, required): Event types to subscribe to: `compliance.acknowledged`, `*` (all events)

**Example request**

```bash
curl -X POST "https://backworkhealth.com/api/v1/webhooks" \
  -H "Authorization: Bearer $BACKWORK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://your-app.com/webhooks/backwork",
  "events": [
    "compliance.acknowledged"
  ]
}'
```

**Example response** (`201`)

```json
{
  "success": true,
  "data": {
    "id": 0,
    "url": "string",
    "events": [
      "string"
    ],
    "status": "string",
    "secret": "string",
    "created_at": "2026-01-15T10:30:00Z"
  },
  "meta": {
    "request_id": "string",
    "timestamp": "2026-01-15T10:30:00Z"
  }
}
```