> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moduluslabs.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Webhook Endpoint

> Register an HTTPS endpoint for Payment Webhook events

<Note>
  The create response contains the endpoint resource, but it does not contain a
  signing secret. After creation, call [Retrieve Signing Secret](/api-reference/payment-webhooks/get-signing-secret)
  with the returned endpoint `id`.
</Note>


## OpenAPI

````yaml api-reference/payment-webhooks/openapi.json POST /v1/webhook_endpoints
openapi: 3.1.0
info:
  title: Modulus Payment Webhooks API
  version: 1.0.0
  description: Manage Payment Webhook endpoints, signing secrets, and persisted events.
servers:
  - url: https://api.sbx.moduluslabs.io
    description: >-
      Sandbox. Use the base URL supplied with your production credentials when
      going live.
security:
  - ApiKey: []
tags:
  - name: Webhook endpoints
  - name: Signing secrets
  - name: Webhook events
paths:
  /v1/webhook_endpoints:
    post:
      tags:
        - Webhook endpoints
      summary: Create a webhook endpoint
      description: >-
        Requires `webhooks.write`. Registers an HTTPS callback and its enabled
        payment event types.
      operationId: createWebhookEndpoint
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEndpointRequest'
      responses:
        '201':
          description: >-
            Endpoint created. The signing secret is not included; retrieve it
            through the signing-secret operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
              example:
                id: ddf3d980-40b9-4aee-91b0-b95d5f29d296
                url: https://merchant.example/webhooks/modulus
                description: Production payment events
                enabled_events:
                  - payment.succeeded
                  - payment.declined
                  - payment.failed
                  - payment.expired
                status: ENABLED
                metadata: {}
                created_at: '2026-09-18T08:00:00.000Z'
                updated_at: '2026-09-18T08:00:00.000Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    CreateEndpointRequest:
      type: object
      required:
        - url
        - enabled_events
      additionalProperties: false
      properties:
        url:
          type: string
          format: uri
          description: Public HTTPS callback URL.
        enabled_events:
          type: array
          minItems: 1
          uniqueItems: true
          description: >-
            Distinct payment event types to deliver to this endpoint. At least
            one is required.
          items:
            $ref: '#/components/schemas/EventType'
        description:
          type:
            - string
            - 'null'
          maxLength: 255
          description: >-
            Optional merchant-defined label for the endpoint. Maximum 255
            characters.
        metadata:
          type:
            - object
            - 'null'
          additionalProperties: true
          maxProperties: 50
          propertyNames:
            maxLength: 40
          description: >-
            Optional endpoint metadata. At most 50 keys, 40 characters per key,
            and 500 characters per string value. `null` is stored as an empty
            object.
    WebhookEndpoint:
      type: object
      required:
        - id
        - url
        - enabled_events
        - status
        - metadata
        - created_at
        - updated_at
      properties:
        id:
          type: string
          format: uuid
          description: Unique webhook endpoint identifier.
        url:
          type: string
          format: uri
          description: Public HTTPS callback URL that receives subscribed events.
        description:
          type:
            - string
            - 'null'
          description: Merchant-defined endpoint label, or `null` when none was supplied.
        enabled_events:
          type: array
          description: Payment event types currently delivered to this endpoint.
          items:
            $ref: '#/components/schemas/EventType'
        status:
          type: string
          enum:
            - ENABLED
            - DISABLED
          description: Delivery state of the endpoint.
        metadata:
          type: object
          additionalProperties: true
          description: >-
            Merchant-owned endpoint metadata. This is endpoint configuration and
            is not payment-event metadata.
        created_at:
          type: string
          format: date-time
          description: UTC RFC 3339 timestamp when the endpoint was created.
        updated_at:
          type: string
          format: date-time
          description: UTC RFC 3339 timestamp when the endpoint was last updated.
    EventType:
      type: string
      description: Payment event type delivered to a subscribed endpoint.
      enum:
        - payment.succeeded
        - payment.declined
        - payment.failed
        - payment.expired
    ErrorEnvelope:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          description: Error returned for an unsuccessful Payment Webhooks API request.
          required:
            - code
            - message
            - correlation_id
          properties:
            code:
              type: string
              description: Machine-readable error code.
              example: INVALID_DESCRIPTION
            message:
              type: string
              description: >-
                Human-readable validation message. Public field tokens retain
                their API spelling; do not branch on its wording.
              example: description must be 255 characters or fewer.
            correlation_id:
              type: string
              format: uuid
              description: Unique request identifier. Include it when contacting support.
  responses:
    BadRequest:
      description: The request failed validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Unauthorized:
      description: The API key is missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Forbidden:
      description: The key lacks the required scope or resource ownership.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    Conflict:
      description: The endpoint or mutation conflicts with existing state.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    PayloadTooLarge:
      description: The request body is too large.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
    InternalError:
      description: An internal error occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: A Modulus API key with the required webhook scope.

````