# Create a webhook endpoint

Registers an HTTPS URL that receives signed events from searches and watches. The signing secret is returned **only** on this response (and on a replay of the same Idempotency-Key). Deliveries use `FounderMCP-Signature`, `FounderMCP-Event-Id` and `FounderMCP-Event-Type`. The event types and the signature are described on Follow-up.

Registers an HTTPS URL that receives signed events from searches and watches. The signing secret is returned **only** on this response (and on a replay of the same Idempotency-Key). Deliveries use `FounderMCP-Signature`, `FounderMCP-Event-Id` and `FounderMCP-Event-Type`. The event types and the signature are described on [Follow-up](/docs/guides/follow-up).

## Authentication

Send `Authorization: Bearer gtk_…`. Create the key under **API Access → API Keys**. A missing, invalid or revoked key is **401**, including while this API is closed. A valid key while the API is closed for your organization answers **404**, the same body as an unknown path. Every response includes `FounderMCP-Api-Version` and `FounderMCP-Request-Id`.

### Headers

- **`Idempotency-Key`** `string` · **required** — Required on this call. The same key and the same body replay the first response for 24 hours (`Idempotent-Replayed: true`). The same key with a different body is `409` `idempotency_conflict`.

### Body parameters

- **`url`** `string` · **required** — HTTPS, port 443, a public host name, up to 2048 characters.
- **`events`** `string[]` — Types to send. Left out means all of them. One of: `search.completed`, `search.failed`, `search.requires_action`, `watch.leads_delivered`, `watch.paused`, `watch.failed_run`.
- **`description`** `string | null` — Up to 200 characters.

## Response

- **`id`** `string` · **required** — Endpoint id, `whe_…`.
- **`object`** `string` · **required** — Always `webhook_endpoint`.
- **`url`** `string` · **required** — Where events are POSTed.
- **`events`** `string[]` · **required** — Subscribed types. `ping` is not in this list; the test always sends it.
- **`status`** `string` · **required** — `enabled`, `disabled` or `deleted`. Disabled after 3 events in a row that used every delivery attempt. One of: `enabled`, `disabled`, `deleted`.
- **`disabled_reason`** `string | null` — `failing`, or null.
- **`secret`** `string` · **required** — Signs every delivery. Shown only on create.

## Credits

Free. Credits are charged when leads are stored, not when a delivery succeeds.

## Errors

- **400** `invalid_request` — The URL is not public HTTPS on port 443.
- **409** `idempotency_conflict` — The Idempotency-Key was already used with another request body.
- **409** `idempotency_in_progress` — The first request with this Idempotency-Key is still being processed. Wait for the Retry-After header.
- **401** `authentication_error` — The Authorization header is missing, or the key is unknown or revoked.
- **403** `permission_error` — API access is not part of your plan, or your account is suspended.
- **404** `not_found` — The endpoint does not exist.
- **429** `rate_limit_error` — More than 60 requests per minute, or more than 3 at the same time, on one key. Wait for the Retry-After header.
- **500** `internal_error` — Something went wrong on our side.

## Example

### cURL

```bash
curl -X POST "https://foundermcp.dev/api/v1/webhook_endpoints" \
  -H "Authorization: Bearer $FOUNDERMCP_API_KEY" \
  -H "Idempotency-Key: idem-1" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/foundermcp",
    "events": [
      "search.completed",
      "watch.leads_delivered"
    ]
  }'
```

### JavaScript

```javascript
const response = await fetch('https://foundermcp.dev/api/v1/webhook_endpoints', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.FOUNDERMCP_API_KEY}`,
    'Idempotency-Key': 'idem-1',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    "url": "https://example.com/foundermcp",
    "events": [
      "search.completed",
      "watch.leads_delivered"
    ]
  })
});
const body = await response.json();
```

### Python

```python
import json
import os
import urllib.request

payload = {
  "url": "https://example.com/foundermcp",
  "events": [
    "search.completed",
    "watch.leads_delivered"
  ]
}

request = urllib.request.Request(
    "https://foundermcp.dev/api/v1/webhook_endpoints",
    headers={
    "Authorization": f"Bearer {os.environ['FOUNDERMCP_API_KEY']}",
    "Idempotency-Key": "idem-1",
    "Content-Type": "application/json"
    },
    data=json.dumps(payload).encode(),
    method="POST",
)
with urllib.request.urlopen(request) as response:
    body = json.load(response)
```

### Example response

```json
{
  "id": "whe_01J9Z6P8C8V0K3W6T2N8R5M1XH",
  "object": "webhook_endpoint",
  "url": "https://example.com/foundermcp",
  "events": [
    "search.completed",
    "watch.leads_delivered"
  ],
  "status": "enabled",
  "disabled_reason": null,
  "secret": "whsec_example"
}
```