# Create a webhook subscription — API reference > Creates a webhook subscription with event types and receiver URL, returning its signing secret once. Source: https://upfour.io/docs/api/webhook-subscriptions/create-a-webhook-subscription [Developers](https://upfour.io/docs/api.md)/[Webhook subscriptions](https://upfour.io/docs/api/webhook-subscriptions.md) Creates a webhook subscription with event types and receiver URL, returning its signing secret once. POST https://app.upfour.io/v1/webhook-subscriptions scope webhook.write beta [Idempotency-Key supported](https://upfour.io/docs/api/idempotency.md) returns 201 ## Body `application/json` required 3 fields eventsstring[] (required) Event types to deliver, at least one; blanks and duplicates are dropped. The service does not check the names, an event that is never published simply never arrives. Published: monitor.created, monitor.updated, monitor.deleted, monitor.status_changed, monitor.degraded_changed, monitor.unstable, monitors.bulk_updated, incident.opened, incident.acknowledged, incident.resolved, incident.reopened, incident.escalated, incident.propagated, incident.partially_recovered, heartbeat.missed, heartbeat.recovered, status_page.update_published, status_page.report_published, webhook.test. urlstring (uri) (required) http or https URL of the receiver. A host that resolves to a private or otherwise blocked address range is refused. All other fields1 fields activeboolean · nullable Defaults to true, also on update: a PUT without active switches a disabled subscription back on. ## Returns A successful request returns `201` with application/json. Response fields 1 top-level fields | Field | Type | Description | | --- | --- | --- | | `data` | WebhookSubscriptionCreated | | | WebhookSubscriptionCreated · 11 fields FieldTypeDescription `active` boolean `created_at` string (date-time) `events` string[] · nullable `failure_count` integer `id` uuid `org_id` uuid `secret` string Signing secret of the subscription, `whsec_` plus 64 hex characters. Returned by this call only; list, update and read calls never include it. Store it now: a lost secret cannot be read back, only replaced with POST /webhook-subscriptions/{subscriptionID}/rotate-secret. The old secret stops signing at once. `updated_at` string (date-time) `url` string `disabled_at` string (date-time) Set while the subscription is switched off, by active: false or by the delivery worker after repeated failures. `last_delivery_at` string (date-time) | | | ## Errors Only the errors this operation can return. Every error uses the [same envelope](https://upfour.io/docs/api/responses.md). | Status | Code | Meaning | | --- | --- | --- | | 400 | [bad_request](https://upfour.io/docs/api/errors#code-bad_request) | The request is malformed or fails validation. | | 402 | [billing_action_unavailable](https://upfour.io/docs/api/errors#code-billing_action_unavailable) | The Company's billing state does not allow this action. **When:** A metered or limited action while the billing state, such as paused or without credit, blocks it; details holds the action and billing_state. **Fix:** Top up the credit or change the plan, then retry. | | 403 | [permission_denied](https://upfour.io/docs/api/errors#code-permission_denied) | The credentials do not permit this action. | | 503 | [quota_gate_unavailable](https://upfour.io/docs/api/errors#code-quota_gate_unavailable) | The limit check itself failed, so the action was not carried out. **When:** The quota service could not decide while the request ran. **Fix:** Retry in a moment; nothing was changed. | | 403 / 429 | [quota_limit_reached](https://upfour.io/docs/api/errors#code-quota_limit_reached) | The Company already holds the most webhook subscriptions it may have; `error.details` carries `purpose` and `limit`. **When:** Counters and concurrency limits answer 429 with Retry-After, inventory and capacity limits answer 403; details holds purpose, limit and window. **Fix:** On 429 wait Retry-After seconds; on 403 free something up, request a higher limit where details.raise_request is true, or buy an extension. `quota_limit_reached` (window `total`): the Company already holds the most of these it may have. `error.details` carries `purpose` and `limit`; remove one or ask support for a higher limit. | Every call can also return `unauthorized` (401), `rate_limit_exceeded` (429) or `internal_error` (500 / 502). See [Responses and errors](https://upfour.io/docs/api/responses.md). [PreviousList webhook subscriptions](https://upfour.io/docs/api/webhook-subscriptions/list-webhook-subscriptions.md) [NextUpdate a webhook subscription](https://upfour.io/docs/api/webhook-subscriptions/update-a-webhook-subscription.md) ## Request ### cURL ```bash curl -s -X POST "https://app.upfour.io/v1/webhook-subscriptions" \ -H "Authorization: Bearer $UP4_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "active": true, "events": [ "incident.opened", "incident.resolved", "monitor.status_changed" ], "url": "https://example.com/hooks/up4" }' ``` ### JavaScript ```javascript const res = await fetch("https://app.upfour.io/v1/webhook-subscriptions", { method: "POST", headers: { Authorization: `Bearer ${process.env.UP4_API_KEY}`, "Content-Type": "application/json", }, body: JSON.stringify({ active: true, events: [ "incident.opened", "incident.resolved", "monitor.status_changed", ], url: "https://example.com/hooks/up4", }), }); console.log(res.status, await res.json()); ``` ### Python ```python import os import requests res = requests.post( "https://app.upfour.io/v1/webhook-subscriptions", headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"}, json={ "active": True, "events": [ "incident.opened", "incident.resolved", "monitor.status_changed", ], "url": "https://example.com/hooks/up4", }, ) print(res.status_code, res.json()) ``` ### Go ```go package main import ( "fmt" "io" "net/http" "os" "strings" ) func main() { payload := strings.NewReader(`{ "active": true, "events": [ "incident.opened", "incident.resolved", "monitor.status_changed" ], "url": "https://example.com/hooks/up4" }`) req, _ := http.NewRequest("POST", "https://app.upfour.io/v1/webhook-subscriptions", payload) req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY")) req.Header.Set("Content-Type", "application/json") res, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer res.Body.Close() out, _ := io.ReadAll(res.Body) fmt.Println(res.StatusCode, string(out)) } ``` ### PHP ```php "POST", CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => [ "Authorization: Bearer " . getenv("UP4_API_KEY"), "Content-Type: application/json", ], CURLOPT_POSTFIELDS => $payload, ]); $response = curl_exec($ch); echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n"; curl_close($ch); ``` ## Response ### 201 ```json { "data": { "active": true, "created_at": "2026-10-27T09:00:00Z", "events": [ "incident.opened", "incident.resolved", "monitor.status_changed" ], "failure_count": 0, "id": "00000000-0000-4000-8000-000000000001", "org_id": "00000000-0000-4000-8000-000000000002", "secret": "whsec_••••", "updated_at": "2026-10-27T09:00:00Z", "url": "https://example.com/hooks/up4" } } ``` ### 400 ```json { "error": { "code": "bad_request", "message": "The request is malformed or fails validation.", "request_id": "req_…" } } ``` ### 402 ```json { "error": { "code": "billing_action_unavailable", "message": "The Company's billing state does not allow this action.", "request_id": "req_…" } } ``` ### 403 ```json { "error": { "code": "permission_denied", "message": "The credentials do not permit this action.", "request_id": "req_…" } } ``` ### 429 ```json { "error": { "code": "quota_limit_reached", "message": "The Company already holds the most webhook subscriptions it may have; error.details carries purpose and limit.", "request_id": "req_…" } } ``` ### 503 ```json { "error": { "code": "quota_gate_unavailable", "message": "The limit check itself failed, so the action was not carried out.", "request_id": "req_…" } } ```