Create webhook endpoint
Register a new outbound webhook endpoint. The response includes
the plaintext signing secret — store it immediately, the API
will never return it again. Subsequent reads expose only
secretLast4.
URL constraints:
- Must be HTTPS.
- Hostname must resolve to a public IP (loopback, link-local,
RFC 1918, and CGNAT ranges are rejected as
ssrf_blocked). - The resolved IP is pinned for ~24h to defeat DNS rebinding; re-resolution happens automatically and may auto-disable the endpoint if the IP starts pointing somewhere private.
Subscribe to one or more event names from the closed list (see
WebhookEventName schema). Subscribing to an unknown name
returns 400 invalid_request.
Requires the webhooks:manage scope.
Documentation Index
Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt
Use this file to discover all available pages before exploring further.
Authorizations
Pass Authorization: Bearer scripe_sk_live_<...> (or
scripe_sk_test_<...> for test keys) on every request. Keys
are scoped to a single workspace and can be revoked from the
Scripe dashboard.
Headers
Pin the API version. Format YYYY-MM-DD. Omit to receive the
currently rolling default. Unknown versions return 400 version_unsupported.
"2026-08-01"
Opaque string (1–64 chars, [A-Za-z0-9_-]) used to dedup
retried writes. Within 24h of the first request, the same key
- same body returns the original response (
Idempotent-Replayed: true). Same key + different body returns409 idempotency_key_conflict.
Strongly recommended for every write — see
/docs/api/v1/idempotency.
^[A-Za-z0-9_-]{1,64}$Body
1 - 128"Production CRM"
1024"https://hooks.example.com/scripe"
1Closed list of subscribable events. Adding a new event name is a contract change — bump the docs + this enum in lockstep with the producer.
note.created, post.created, post.updated, post.scheduled, post.unscheduled, source.created, job.completed, job.failed, knowledge.indexed ["post.created", "job.completed"]Optional project scope. When set, the endpoint only
receives events for that project. null (default)
delivers events for every project in the workspace.
"proj_a1b2c3d4e5f6g7h8"
Response
Endpoint created. Response carries the plaintext secret.
Display-safe shape of a webhook endpoint. The plaintext signing
secret is never present here — only secretLast4. Use
WebhookEndpointWithSecret (returned by create + rotate) when
the plaintext matters.