Create a webhook endpoint
Adds an endpoint and makes its signing secret, which this answer shows once. The address must be https:// and on the public internet: private, local and cloud metadata addresses are refused here and again before every delivery. A team has at most 20 endpoints.
api_key webhooksAuthorizationBearer <token>A team API key, made by an admin under Settings, API keys. Send it as Authorization: Bearer chk_....
Scope: webhooks
application/json- body
A new endpoint.
description?|A note for people: what the endpoint is for.
"Deploy bot"enabled?|Defaults to true.
trueevents?array<string>|Event types to receive, or ["*"] for every event. Defaults to every
event.
[ "run.completed", "run.failed"]url*stringAn https:// address on the public internet.
"https://hooks.example.com/coderhelm"Created. Keep the secret.
application/json- response
A new endpoint and its signing secret. The secret is shown here once;
reveal it later with GET …/secret.
endpoint*A webhook endpoint. Never carries its secret.
secret*stringwhsec_ and 32 random bytes in base64. Verify signatures with it.
"whsec_C2FVsBQIhrscChlQIMV+b5sSYspob7oD7vS8nSUIQ2c="curl -X POST 'https://api.coderhelm.com/api/webhooks/endpoints' \ -H "Authorization: Bearer $CODERHELM_API_KEY" \ -H 'Content-Type: application/json' \ -d '{ "url": "https://hooks.example.com/coderhelm"}'{ "endpoint": { "created_at": "2026-10-20T09:00:00Z", "created_by": "lead@example.com", "description": "Deploy bot", "disabled_reason": "", "enabled": true, "events": [ "run.completed", "run.failed" ], "failing_since": null, "id": "ep_01jbendpt4a7b0c3d6e9f2g5h8", "last_failure_at": "2026-10-25T08:02:11.004Z", "last_success_at": "2026-10-26T14:31:48.120Z", "previous_secret_expires_at": "2026-10-27T09:00:00Z", "secret_hint": "whsec_…Q2c=", "updated_at": "2026-10-20T09:00:00Z", "url": "https://hooks.example.com/coderhelm" }, "secret": "whsec_C2FVsBQIhrscChlQIMV+b5sSYspob7oD7vS8nSUIQ2c="}