## Create a webhook endpoint

**post** `/v1/webhook_endpoints`

Registers a URL and returns its signing secret.

**The secret is returned once, here.** Nothing reads it back afterwards.

A brand may hold up to 16 endpoints; a seventeenth is refused `409`
`endpoint_limit_reached`.

### Body Parameters

- `enabled_events: array of string`

  The events this endpoint should receive. Must be non-empty, and every name must be one this API emits: a name we do not emit is refused rather than accepted and then matching nothing.

- `url: string`

  Absolute `https` URL. A private or loopback address is refused here rather than failing silently later.

- `description: optional string`

  Your own label, ≤200 bytes.

### Returns

- `WebhookEndpointWithSecret object { id, created_at, description, 4 more }`

  A newly created or newly rotated endpoint. **The `secret` is on this
  response and on no other**; store it now; it is never readable again, and
  a lost secret is replaced by rotating rather than by looking it up.

  - `id: string`

    `wh_…`.

  - `created_at: string`

  - `description: string`

    Your own label. Free text, ≤200 bytes, never interpreted.

  - `enabled_events: array of string`

    The event types this endpoint receives. Exact names: no wildcards.

  - `secret: string`

    `whsec_…`. Sign-verify every delivery with it. Shown once.

  - `status: "enabled" or "disabled"`

    `enabled` while it receives deliveries, `disabled` once you turn it off.
    A disabled endpoint keeps its secret and its history and resumes on
    `PATCH {"disabled": false}`.

    - `"enabled"`

    - `"disabled"`

  - `url: string`

    Absolute `https` URL every delivery for this endpoint is POSTed to.

### Example

```http
curl https://messages.api.linqapp.com/v1/webhook_endpoints \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $LINQ_AMB_API_KEY" \
    -d '{
          "enabled_events": [
            "message.received",
            "message.sent",
            "message.failed"
          ],
          "url": "https://hooks.example.com/messages"
        }'
```

#### Response

```json
{
  "id": "wh_7f3a1c9e",
  "url": "https://hooks.example.com/messages",
  "description": "production receiver",
  "enabled_events": [
    "message.received",
    "message.sent",
    "message.failed"
  ],
  "status": "enabled",
  "created_at": "2026-08-13T02:41:09Z",
  "secret": "whsec_9Qm2ZK8vTn1xR4pL7bYcW0sHdJfA6eUg3iOtN5rXvBk="
}
```