> ## Documentation Index
> Fetch the complete documentation index at: https://docs.watx.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a webhook endpoint

> Registers an endpoint and subscribes it to one or more events. The `url`
must be `https://` and must resolve to a public address.

The response carries `secret` **once**. Store it: Watx keeps only an
encrypted copy and no read path returns it again. Use it to verify the
`X-Watx-Signature` header on every delivery.

Requires the `webhooks:manage` scope.




## OpenAPI

````yaml /openapi.yaml post /webhooks
openapi: 3.1.0
info:
  title: Watx API
  version: '1'
  description: |
    The Watx public REST API. Send WhatsApp messages, manage contacts and
    segments, read conversations and messages, launch broadcasts, and register
    webhook endpoints.

    Every request authenticates with a workspace API key sent as a bearer
    token. A key acts on exactly one workspace and can only do what its scopes
    allow. Each operation below names the scope it requires.
  contact:
    name: Watx support
    email: support@watx.in
servers:
  - url: https://api.watx.in/v1
    description: Production
security:
  - apiKey: []
tags:
  - name: Account
    description: Check which workspace a key belongs to and what it can do.
  - name: Messages
    description: Send a WhatsApp message to a phone number.
  - name: Contacts
    description: Create, read, update and list contacts.
  - name: Conversations
    description: Read conversations and their messages.
  - name: Broadcasts
    description: Launch a template broadcast and follow its progress.
  - name: Segments
    description: Named audiences — static lists and saved filters.
  - name: Webhooks
    description: Register endpoints that receive events from your workspace.
paths:
  /webhooks:
    post:
      tags:
        - Webhooks
      summary: Register a webhook endpoint
      description: |
        Registers an endpoint and subscribes it to one or more events. The `url`
        must be `https://` and must resolve to a public address.

        The response carries `secret` **once**. Store it: Watx keeps only an
        encrypted copy and no read path returns it again. Use it to verify the
        `X-Watx-Signature` header on every delivery.

        Requires the `webhooks:manage` scope.
      operationId: createWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
            example:
              url: https://example.com/hooks/watx
              events:
                - message.received
                - message.status_updated
      responses:
        '201':
          description: The endpoint, with its signing secret.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/WebhookEndpointWithSecret'
              example:
                data:
                  id: 5b6c7d8e-9f01-4a2b-8c3d-4e5f6a7b8c9d
                  url: https://example.com/hooks/watx
                  events:
                    - message.received
                    - message.status_updated
                  is_active: true
                  last_delivery_at: null
                  failure_count: 0
                  created_at: '2026-09-15T06:41:02.000Z'
                  provider: api
                  secret: whsec_Zm9vYmFyYmF6cXV4MTIzNDU2Nzg5MGFiY2RlZmdoaWo
        '400':
          description: |
            A `url` that is not a valid `https://` URL, or an `events` array
            that is empty or names an unknown event.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error:
                  code: bad_request
                  message: '''events'' must be a non-empty array of known event names'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/RateLimited'
components:
  schemas:
    CreateWebhookRequest:
      type: object
      required:
        - url
        - events
      properties:
        url:
          type: string
          format: uri
          description: An `https://` URL that resolves to a public address.
        events:
          type: array
          minItems: 1
          items:
            $ref: '#/components/schemas/WebhookEvent'
    WebhookEndpointWithSecret:
      allOf:
        - $ref: '#/components/schemas/WebhookEndpoint'
        - type: object
          properties:
            secret:
              type: string
              description: |
                The signing secret, returned only when the endpoint is created.
                Starts with `whsec_`.
    Error:
      type: object
      description: |
        Every failure uses this shape. Branch on `error.code`, which is stable;
        `error.message` is written for people and may be reworded.
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: |
                One of `bad_request`, `invalid_request`, `unauthorized`,
                `forbidden`, `not_found`, `rate_limited`, `internal`, or a
                domain code such as `whatsapp_not_configured`, `meta_error`,
                `template_malformed`, `plan_limit_reached`,
                `subscription_lapsed`.
              example: bad_request
            message:
              type: string
              example: '''phone'' is required'
    WebhookEvent:
      type: string
      enum:
        - message.received
        - message.status_updated
        - conversation.created
        - contact.created
    WebhookEndpoint:
      type: object
      properties:
        id:
          type: string
          format: uuid
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            $ref: '#/components/schemas/WebhookEvent'
        is_active:
          type: boolean
          description: |
            False once the endpoint has been disabled automatically after 15
            consecutive failed events, or because you paused it.
        last_delivery_at:
          type:
            - string
            - 'null'
          format: date-time
          description: When a delivery was last accepted.
        failure_count:
          type: integer
          description: Consecutive failed events. Reset by a success or by re-enabling.
        created_at:
          type: string
          format: date-time
        provider:
          type: string
          enum:
            - api
            - zapier
            - n8n
          description: |
            Which surface registered the endpoint. Read-only, and it has no
            effect on delivery — it decides which dashboard page manages the
            endpoint.
  responses:
    Unauthorized:
      description: |
        The key is missing, malformed, unknown, revoked or expired. All four
        answer the same way.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: unauthorized
              message: Missing or invalid API key
    Forbidden:
      description: The key is valid but was not granted the scope this operation requires.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: forbidden
              message: This API key is missing the 'messages:send' scope
    RateLimited:
      description: |
        More than 120 requests in a minute for this key. `Retry-After` says how
        many seconds to wait.
      headers:
        Retry-After:
          description: Seconds until the window resets.
          schema:
            type: integer
        X-RateLimit-Limit:
          description: Requests allowed per window.
          schema:
            type: integer
        X-RateLimit-Remaining:
          description: Requests left in this window.
          schema:
            type: integer
        X-RateLimit-Reset:
          description: Unix time in seconds when the window resets.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: rate_limited
              message: Rate limit exceeded for this API key
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      description: |
        Your workspace API key, created in **Settings → API keys**, sent as
        `Authorization: Bearer <key>`. New keys start with `watx_live_`; keys
        issued before the rename start with `converse360_live_` and still work.

````