Create a webhook · Sigil Documentation

Store the secret where your receiver can read it: it is not shown again, though you can roll it. Then send a ping to check the receiver. The URL must be a public HTTPS address; private, local and link-local addresses are refused, both here and when the name is resolved at delivery time.

Authorization

Authorizationstringheaderrequired

Bearer followed by your API key: Bearer sgk_…. The key also works in an X-Api-Key header. See Authentication.

Body

application/json

urlstringrequired

Where to post, https:// only, 500 characters at most. No user name, password or #fragment.

eventsarray of strings

The event types to receive. Leave it out, or send null or [], for every pact event. A ping is always delivered.

descriptionstring

A note on what the endpoint is for (100 characters at most).

Response

201 CreatedThe new webhook, with its secret.

uidstring

The endpoint's id: 8 letters and digits.

urlstring

Where events are posted: a public HTTPS URL.

descriptionstring | null

Your note on what it is for (100 characters at most).

eventsarray of strings | null

The event types it receives, or null for every pact event. A ping is delivered whatever this says.

activeboolean

Whether events are delivered to it. Switched off by you, by a 410 Gone answer, or after 10 failed deliveries in a row; switch it on again with Update a webhook.

consecutive_failuresinteger

Deliveries given up on since the last success. Resets to 0 on the next success.

last_statusinteger | null

The HTTP status of the last attempt. null before the first attempt, and when the last attempt got no response.

date_last_successstring (date-time) | null

When a delivery last got a 2xx.

date_disabledstring (date-time) | null

When it was switched off, while it is.

date_createdstring (date-time)

When it was added.

date_updatedstring (date-time)

When its settings or secret last changed.

secretstring

The signing secret, sgw_ and 40 letters and digits. Keep it where your receiver can read it.

Only in the response to Create a webhook and Roll the secret. It cannot be read back later.

Errors

Status	When
400 Bad Request	The body is not a JSON object; the URL is missing, not HTTPS, not public, or malformed; or an event is unknown.
401 Unauthorized	The API key is missing, wrong or revoked.
403 Forbidden	The account's plan does not include API access (Pro and Business do).
409 Conflict	The account already has 10 endpoints.

Every error body is { "error": "message" }. See Errors.