# createWebhookEndpoint — Postify API

`POST /v1/webhook-endpoints`

Create a webhook endpoint. Registers an HTTPS endpoint for event deliveries. The URL is validated against SSRF at creation AND re-validated at every delivery (loopback, private-network, link-local, and cloud-metadata addresses are rejected — 400 `validation_failed`). The response includes the Standard-Webhooks signing secret exactly once. Endpoint creation counts against the plan's `integrations` quota.

- Required scope: `webhooks:write`
- Auth: `Authorization: Bearer postify_live_…` or `x-api-key` header

## Request body

- `url` (string, required) — HTTPS URL on the default port (443). Loopback, private, link-local, and cloud-metadata addresses are rejected — at creation AND at every delivery.
- `event_types` (array of "post.published" | "post.failed" | "channel.connected" | "channel.reauth_required" | "delivery.failed", required) — Event types to subscribe to (at least one).

## Responses

- `201` — The created endpoint with its show-once signing secret. (schema: `WebhookEndpointCreated`)
- `400` — [`invalid_request`](https://usepostify.com/docs/api/problems/invalid-request.md), [`validation_failed`](https://usepostify.com/docs/api/problems/validation-failed.md)
- `401` — [`authentication_required`](https://usepostify.com/docs/api/problems/authentication-required.md), [`invalid_api_key`](https://usepostify.com/docs/api/problems/invalid-api-key.md)
- `403` — [`insufficient_scope`](https://usepostify.com/docs/api/problems/insufficient-scope.md), [`feature_not_enabled`](https://usepostify.com/docs/api/problems/feature-not-enabled.md)
- `429` — [`rate_limited`](https://usepostify.com/docs/api/problems/rate-limited.md), [`quota_exhausted`](https://usepostify.com/docs/api/problems/quota-exhausted.md)
- `500` — [`internal_error`](https://usepostify.com/docs/api/problems/internal-error.md)

Errors are RFC 9457 `application/problem+json` with a stable `code` and a `request_id`. Full schemas: [interactive reference](https://usepostify.com/docs/api-reference) · [OpenAPI spec](https://app.usepostify.com/v1/openapi.json).

## Example (curl)

```bash
curl -X POST https://app.usepostify.com/v1/webhook-endpoints \
  -H "Authorization: Bearer postify_live_XXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://api.example.com/postify/webhooks",
  "event_types": [
    "post.published",
    "post.failed"
  ]
}'
```

## Example (TypeScript)

```ts
const res = await fetch("https://app.usepostify.com/v1/webhook-endpoints", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.POSTIFY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
      "url": "https://api.example.com/postify/webhooks",
      "event_types": [
        "post.published",
        "post.failed"
      ]
    }),
});

if (!res.ok) {
  // RFC 9457 problem+json: branch on the stable `code`.
  const problem = await res.json();
  throw new Error(`${problem.code}: ${problem.detail ?? problem.title}`);
}
const data = await res.json();
```