Register a new webhook endpoint

POST 
/webhooks

Registers an HTTP endpoint on the reseller's own server, subscribing it to the selected events. The secret plain HMAC secret returned in the response is shown ONLY once.

The target URL is strict: only https, user info (user:pass@) forbidden, private/internal IPs rejected (SSRF protection).

Request

Responses

201

Endpoint created (secret returned once)

401

Authentication failed — missing header, wrong credential, outside the IP whitelist, or a revoked key. No detail is leaked; all cases return a single message.

Response Headers

WWW-Authenticate

RFC 7617 Basic Auth challenge

409

Active webhook limit exceeded (webhook_limit_exceeded)

422

Validation error (invalid URL / unknown event)

429

Per-minute limit exceeded

Response Headers

Retry-After

Seconds to wait before retrying after a 429 (RFC 7231 §7.1.3)

X-RateLimit-Limit

The per-minute limit defined for this key

X-RateLimit-Remaining
X-RateLimit-Reset

Unix epoch of the start of the next window (UTC seconds)