Adds an endpoint that receives the selected team events. The response carries the signing secret — the only time it is shown. Requests are signed the Standard Webhooks way (webhook-id, webhook-timestamp, webhook-signature). The endpoint must use https:// and resolve to a public address; a team can have at most 10 webhooks.
Permission required: webhook:manage
Request Body
Endpoint URL. Must start with https:// and must not resolve to a private, loopback or reserved address.
Send every event type, including types added in the future
Description, at most 100 characters
Event types to send (see List Event Types ). Required unless all_events is true; unknown types are ignored.
Response
Show Webhook With Secret object
Signing secret (whsec_…). Shown only in this response — store it now; a lost secret can only be rotated.
true = every event type is sent, including types added in the future; events is then the selection kept for when this is switched off
When the webhook was added, Unix seconds
Description; empty when none was given
auto_disabled = turned off after every delivery failed for 3 days; enable it after fixing the endpoint. One of: enabled, disabled, auto_disabled.
Endpoint URL events are sent to
Identifier of the webhook
Member who added the webhook
Time of the latest attempt, Unix seconds; absent if nothing was sent yet
Whether the latest delivery succeeded
previous_secret_expires_at Until when the previous secret still signs requests after a rotation, Unix seconds; absent outside that window
When the signing secret was last rotated, Unix seconds; absent if never
Errors
Errors answer with success: false, a message and an error_code. See Error Codes for every code.