Create an event webhook (10 per app at most)
Operation ID: createWebhook
Adds an HTTPS endpoint. The URL must be https, on a public host and a standard port (400 invalid_request otherwise). The response includes the signing secret; this and rotateWebhookSecret are the only calls that return it, so store it now. 409 conflict when the app already has 10 endpoints. See Webhook events for what is sent and how to verify it.
Needs an API key with the manage scope.
apiKeyAuthorizationBearer <oq_ followed by 43 letters and digits>An Outqube API key, made in the app's settings. It belongs to one app and has the scope read, trigger or manage; a higher scope includes the lower ones. A revoked or expired key is a 401.
application/json- body
url*stringAn https:// URL on a public host, standard port.
1 <= length <= 2048events?array<never>|array<>Event types to send, or ["*"] for all of them.
description?stringYour note on what the endpoint is for, up to 200 characters.
length <= 200""enabled?booleanStart sending straight away; default true.
trueCreated
application/json- response
An endpoint with its signing secret, returned only on create and on rotate.
id*stringThe endpoint's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidapp_id*stringThe app the endpoint belongs to.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidurl*stringWhere Outqube sends the events.
urievents*array<string>Event types sent, or ["*"] for all of them.
description*stringYour note on what the endpoint is for; empty when not set.
enabled*booleanWhether Outqube sends events to the endpoint.
disabled_reason*|manual: switched off by a person. failures: 5 messages in a row ran out of retries. Null while enabled.
disabled_at*|When it was switched off, or null.
consecutive_failures*integerMessages in a row that ran out of retries; any delivery resets it.
-9007199254740991 <= value <= 9007199254740991secret_hint*stringThe last 4 characters of the signing secret.
previous_secret_expires_at*|After a rotation, when the previous secret stops signing; else null.
created_at*stringWhen the endpoint was created.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timeupdated_at*stringWhen the endpoint last changed.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timesecret*stringThe signing secret, whsec_ + base64. Shown here and in settings.
curl -X POST 'https://app.outqube.com/api/v1/webhooks' \ -H 'Content-Type: application/json' \ -d '{ "url": "https://ci.acme.test/hooks/outqube", "events": [ "run.completed", "run.cancelled" ], "description": "Post results to CI"}'{ "id": "d8f0b2a4-6c1e-4d73-9a5b-1c3e5a7b9d46", "app_id": "9b1d2f4e-7a3c-4c58-9e0b-6f3a1d2c4b5a", "url": "https://ci.acme.test/hooks/outqube", "events": [ "run.completed", "run.cancelled" ], "description": "Post results to CI", "enabled": true, "disabled_reason": null, "disabled_at": null, "consecutive_failures": 0, "secret_hint": "k3Fz", "previous_secret_expires_at": null, "created_at": "2026-10-25T10:00:00.000Z", "updated_at": "2026-10-25T10:00:00.000Z", "secret": "whsec_c2FtcGxlLXdlYmhvb2sta2V5LW5vdC1hLXNlY3JldCE="}