Create an outbound webhook

POST

/webhooks

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    RequestUri = new Uri("https://api.vendorica.com/v1/webhooks"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
    Content = new StringContent("{ \"name\": \"example\", \"triggers\": [ \"example\" ], \"endpoint\": \"https://example.com\", \"customHeaders\": [ { \"name\": \"example\", \"value\": \"example\" } ], \"signingEnabled\": true, \"retryPolicy\": { \"enabled\": true, \"maxAttempts\": 1, \"backoff\": \"exponential\", \"initialDelaySeconds\": 1, \"maxDelaySeconds\": 1, \"retryOn\": [ \"timeout\" ] }, \"failureHandling\": { \"autoDisableAfter\": 1, \"disableOnGone\": true } }")
    {
        Headers =
        {
            ContentType = new MediaTypeHeaderValue("application/json")
        }
    }
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://api.vendorica.com/v1/webhooks"

  payload := strings.NewReader("{ \"name\": \"example\", \"triggers\": [ \"example\" ], \"endpoint\": \"https://example.com\", \"customHeaders\": [ { \"name\": \"example\", \"value\": \"example\" } ], \"signingEnabled\": true, \"retryPolicy\": { \"enabled\": true, \"maxAttempts\": 1, \"backoff\": \"exponential\", \"initialDelaySeconds\": 1, \"maxDelaySeconds\": 1, \"retryOn\": [ \"timeout\" ] }, \"failureHandling\": { \"autoDisableAfter\": 1, \"disableOnGone\": true } }")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{ \"name\": \"example\", \"triggers\": [ \"example\" ], \"endpoint\": \"https://example.com\", \"customHeaders\": [ { \"name\": \"example\", \"value\": \"example\" } ], \"signingEnabled\": true, \"retryPolicy\": { \"enabled\": true, \"maxAttempts\": 1, \"backoff\": \"exponential\", \"initialDelaySeconds\": 1, \"maxDelaySeconds\": 1, \"retryOn\": [ \"timeout\" ] }, \"failureHandling\": { \"autoDisableAfter\": 1, \"disableOnGone\": true } }");
Request request = new Request.Builder()
  .url("https://api.vendorica.com/v1/webhooks")
  .post(body)
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build();

Response response = client.newCall(request).execute();

const url = 'https://api.vendorica.com/v1/webhooks';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"name":"example","triggers":["example"],"endpoint":"https://example.com","customHeaders":[{"name":"example","value":"example"}],"signingEnabled":true,"retryPolicy":{"enabled":true,"maxAttempts":1,"backoff":"exponential","initialDelaySeconds":1,"maxDelaySeconds":1,"retryOn":["timeout"]},"failureHandling":{"autoDisableAfter":1,"disableOnGone":true}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://api.vendorica.com/v1/webhooks";

    let payload = json!({
        "name": "example",
        "triggers": ("example"),
        "endpoint": "https://example.com",
        "customHeaders": (
            json!({
                "name": "example",
                "value": "example"
            })
        ),
        "signingEnabled": true,
        "retryPolicy": json!({
            "enabled": true,
            "maxAttempts": 1,
            "backoff": "exponential",
            "initialDelaySeconds": 1,
            "maxDelaySeconds": 1,
            "retryOn": ("timeout")
        }),
        "failureHandling": json!({
            "autoDisableAfter": 1,
            "disableOnGone": true
        })
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());
    headers.insert("Content-Type", "application/json".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .json(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request POST \
  --url https://api.vendorica.com/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "triggers": [ "example" ], "endpoint": "https://example.com", "customHeaders": [ { "name": "example", "value": "example" } ], "signingEnabled": true, "retryPolicy": { "enabled": true, "maxAttempts": 1, "backoff": "exponential", "initialDelaySeconds": 1, "maxDelaySeconds": 1, "retryOn": [ "timeout" ] }, "failureHandling": { "autoDisableAfter": 1, "disableOnGone": true } }'

Creates one webhook entry (name + triggers + endpoint + optional custom headers + optional HMAC signing + optional retryPolicy / failureHandling; an omitted policy field takes its default). Every trigger must be available on the org’s plan (see GET /webhooks/triggers); the endpoint must be a public HTTPS URL (private / loopback / metadata addresses are rejected). When signingEnabled is true the response carries signingSecret exactly once. Subject to the plan’s webhook-count cap (409 when exceeded). A trigger name that is not in the catalogue is a 422 VALIDATION_ERROR naming triggers; a trigger that exists but is not on the plan is a 403. Either way the whole request is refused — no subset is created.

Authorizations

bearerAuth
webhooks:write

Request Body^required

Webhook configuration

application/json

object

name

required

string

>= 1 characters <= 120 characters

triggers

required

Array<string>

>= 1 items <= 50 items

endpoint

required

string format: uri

<= 2048 characters

customHeaders

Array<object>

<= 20 items

object

name

required

string

>= 1 characters <= 128 characters

value

required

string

<= 4096 characters

signingEnabled

boolean

retryPolicy

object

enabled

boolean

maxAttempts

integer

>= 1 <= 10

backoff

string

Allowed values: exponential fixed

initialDelaySeconds

integer

>= 10 <= 3600

maxDelaySeconds

integer

>= 60 <= 86400

retryOn

Array<string>

<= 6 items

Allowed values: timeout network http_408 http_429 http_5xx http_4xx

failureHandling

object

autoDisableAfter

integer

>= 1 <= 100

disableOnGone

boolean

Responses

201

Success

application/json

object

success

required

boolean

data

required

object

webhook

required

object

required

string format: uuid

organizationId

required

string format: uuid

name

required

string

triggers

required

Array<string>

endpoint

required

string format: uri

status

required

string

Allowed values: active disabled suspended

apiVersion

required

string

customHeaders

required

Array<object>

object

name

required

string

valueHint

required

string

signing

required

object

enabled

required

boolean

secretHint

required

string | null

retryPolicy

required

object

enabled

required

boolean

maxAttempts

required

integer

backoff

required

string

Allowed values: exponential fixed

initialDelaySeconds

required

integer

maxDelaySeconds

required

integer

retryOn

required

Array<string>

Allowed values: timeout network http_408 http_429 http_5xx http_4xx

failureHandling

required

object

autoDisableAfter

required

integer

disableOnGone

required

boolean

consecutiveFailures

required

integer

lastSuccessAt

required

string | null format: date-time

lastFailureAt

required

string | null format: date-time

disabledReason

required

string | null

createdAt

required

string | null format: date-time

updatedAt

required

string | null format: date-time

signingSecret

string

timestamp

required

string format: date-time

requestId

string

message

string

Example

{
  "success": true,
  "data": {
    "webhook": {
      "id": "53cbd165-50da-4525-8e31-fad24eaddee2",
      "organizationId": "8a0d4fa0-f4f4-4c06-81ac-dbdf5e1e19c1",
      "name": "string",
      "triggers": [
        "string"
      ],
      "endpoint": "https://example.com",
      "status": "active",
      "apiVersion": "string",
      "customHeaders": [
        {
          "name": "string",
          "valueHint": "string"
        }
      ],
      "signing": {
        "enabled": true,
        "secretHint": "string"
      },
      "retryPolicy": {
        "enabled": true,
        "maxAttempts": 1,
        "backoff": "exponential",
        "initialDelaySeconds": 1,
        "maxDelaySeconds": 1,
        "retryOn": [
          "timeout"
        ]
      },
      "failureHandling": {
        "autoDisableAfter": 1,
        "disableOnGone": true
      },
      "consecutiveFailures": 1,
      "lastSuccessAt": "2026-08-19T09:41:12.004Z",
      "lastFailureAt": "2026-08-19T09:41:12.004Z",
      "disabledReason": "string",
      "createdAt": "2026-08-19T09:41:12.004Z",
      "updatedAt": "2026-08-19T09:41:12.004Z"
    },
    "signingSecret": "string"
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Validation error

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Unauthorized

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Forbidden — missing scope

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Not found

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Rate limit exceeded

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

Create an outbound webhook

Authorizations

Request Bodyrequired

Responses

201

Example

400

Example

401

Example

403

Example

404

Example

429

Example

Request Body^required