> ## Documentation Index
> Fetch the complete documentation index at: https://docs.staging.questra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook endpoint

> Register a URL to receive events. Returns a signing secret once — store it securely. Payloads are signed with Standard Webhooks.



## OpenAPI

````yaml /openapi/program.openapi.json post /webhook_endpoints
openapi: 3.1.0
info:
  title: Questra Program API
  version: 0.0.1
  description: >-
    REST API for the Questra Program product. Browser users authenticate through
    Questra Auth SSO; automation uses workspace-scoped API keys (`Authorization:
    Bearer qpk_live_…`). API keys carry scopes enforced before handlers.
    Outbound webhooks follow Standard Webhooks (at-least-once delivery;
    consumers must be idempotent).
servers:
  - url: /v1
    description: Program API base path
security: []
paths:
  /webhook_endpoints:
    post:
      tags:
        - Webhook endpoints
      summary: Create webhook endpoint
      description: >-
        Register a URL to receive events. Returns a signing secret once — store
        it securely. Payloads are signed with Standard Webhooks.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookEndpointRequest'
      responses:
        '201':
          description: Webhook endpoint created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateWebhookEndpointResponse'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrorBody'
components:
  schemas:
    CreateWebhookEndpointRequest:
      type: object
      properties:
        url:
          type: string
          format: uri
          example: https://example.com/hooks/questra
        description:
          type: string
          example: Staging sync
        enabled:
          type: boolean
          example: true
        event_types:
          type: array
          items:
            $ref: '#/components/schemas/WebhookEventType'
          minItems: 1
          example:
            - survey.created
            - file.ready
      required:
        - url
        - event_types
    CreateWebhookEndpointResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/WebhookEndpointWithSecret'
      required:
        - data
    ValidationErrorBody:
      type: object
      properties:
        error:
          type: string
          enum:
            - validation_error
        message:
          type: string
        details: {}
      required:
        - error
    WebhookEventType:
      type: string
      enum:
        - survey.created
        - survey.updated
        - survey.deleted
        - file.created
        - file.updated
        - file.ready
        - file.deleted
        - questionnaire.updated
        - questionnaire.clarifications.updated
        - survey.audit.updated
        - workflow.started
        - workflow.updated
        - workflow.finished
        - content.updated
    WebhookEndpointWithSecret:
      allOf:
        - $ref: '#/components/schemas/WebhookEndpoint'
        - type: object
          properties:
            secret:
              type: string
              example: whsec_a1b2c3d4e5f6g7h8i9j0
              description: >-
                Signing secret for Standard Webhooks verification. Returned only
                on create and rotate.
          required:
            - secret
    WebhookEndpoint:
      type: object
      properties:
        id:
          type: string
          format: uuid
        url:
          type: string
          format: uri
        description:
          type: string
        enabled:
          type: boolean
        event_types:
          type: array
          items:
            $ref: '#/components/schemas/WebhookEventType'
          minItems: 1
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
        - id
        - url
        - enabled
        - event_types
        - created_at
        - updated_at

````