Register a webhook endpoint

​

The signing secret (whsec_...) is returned only in the creation response. Store it; every delivery is signed with it (see the Webhooks section). Idempotent replays return the endpoint without the secret.

Headers
  • Idempotency-Key
    Type: string
    min length:  
    1
    max length:  
    255
    required

    Required on every POST, before any effect. Replays with the same key return the original resource with 200.

Body·
required
application/json
  • event_types
    Type: array string[] · 1…enum
    required
  • url
    Type: string
    max length:  
    2000    Format: uri
    required

    Must be https.

Responses
  • application/json
  • application/json
  • application/problem+json
  • application/problem+json
Request Example for post/v1/webhook_endpoints
curl https://api.sandbox.rostergiving.com/v1/webhook_endpoints \
  --request POST \
  --header 'Idempotency-Key: ' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_SECRET_TOKEN' \
  --data '{
  "url": "",
  "event_types": [
    "partner_session.created"
  ]
}'

{
  "id": "we_9d8c7b6a5f4e",
  "url": "https://example.com",
  "event_types": [
    "partner_session.created"
  ],
  "status": "active",
  "created_at": "2026-09-01T19:58:46.893Z",
  "secret": "string"
}

Idempotent replay — same endpoint, without secret.