POST/webhooks
Create a webhook subscription with the PostEverywhere API
PostEverywhere POSTs event payloads to your URL, signed with HMAC-SHA256 in the `X-PostEverywhere-Signature` header (`sha256=<hmac>` over the raw body using the returned `secret`). Delivery headers also include `X-PostEverywhere-Event`, `X-PostEverywhere-Event-Id`, `X-PostEverywhere-Timestamp` and `X-PostEverywhere-Delivery-Id`. The `secret` is returned ONLY on creation. URLs are SSRF-validated (no localhost/private/metadata addresses). Max 25 webhooks per organization (`400 limit_reached`). Unknown events → `400 invalid_event_type`.
Guide: Webhooks guide
This endpoint accepts a JSON request body. See the webhooks guide for a worked example.
Responses
- 201Created — includes the one-time signing secret
- 400
- 401
- 402
- 403
- 429
- 500