> ## Documentation Index
> Fetch the complete documentation index at: https://docs.integrateledger.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook endpoint

> Register a URL for Ledger to send signed events to, in the environment your API key selects.

Ledger sends the events in `enabledEvents` to `url`, signed with the endpoint's secret. Use `["*"]` for every event, including ones added later. The [event reference](https://docs.integrateledger.com/webhooks.md#events) lists each type.

The response carries the signing secret (`whsec_…`) once. Store it, then [verify each request](https://docs.integrateledger.com/webhooks.md#verify-the-signature) with it. To replace it, rotate the secret in **Settings › Webhooks**.

* **URL:** Live endpoints must be public `https://` URLs. Private, loopback and internal hosts are refused.
* **Limit:** 16 endpoints per environment; another returns `409 endpoint_limit_reached`.
* **Errors:** an unknown event type is `400 invalid_request`; a URL Ledger can't send to is `400 https_required`, `private_address`, `credentials_in_url` or `invalid_url`.


## OpenAPI

````yaml openapi.json POST /v1/webhook-endpoints
openapi: 3.1.0
info:
  title: Ledger API
  version: 0.1.0
servers:
  - url: https://api.integrateledger.com
    description: Hosted Ledger API
security: []
paths:
  /v1/webhook-endpoints:
    post:
      tags:
        - Webhooks
      summary: Create a webhook endpoint
      description: >-
        The response's secret is returned only here. Store it and verify each
        request's Ledger-Signature header with it; see the Webhooks guide.
      operationId: createWebhookEndpoint
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookEndpointInput'
      responses:
        '201':
          description: Endpoint created, with its signing secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedWebhookEndpoint'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookError'
        '401':
          description: Invalid Ledger API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookError'
        '409':
          description: The environment already has 16 endpoints
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookError'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
      security:
        - ApiKey: []
      x-codeSamples:
        - lang: python
          label: Python SDK
          source: >-
            import os

            from integrateledger import ledger


            client = ledger(api_key=os.environ["LEDGER_API_KEY"])

            client.create_webhook_endpoint(url="https://example.com/webhooks/ledger",
            enabled_events=["subscription.created", "balance.low"])
        - lang: bash
          label: cURL
          source: >-
            curl --request POST
            'https://api.integrateledger.com/v1/webhook-endpoints' \
              -H "Authorization: Bearer $LEDGER_API_KEY" \
              -H 'Content-Type: application/json' \
              --data '{"url":"https://example.com/webhooks/ledger","enabledEvents":["subscription.created","balance.low"]}'
        - lang: typescript
          label: TypeScript SDK
          source: >-
            import ledger from "integrateledger";


            const client = new ledger({ apiKey: process.env.LEDGER_API_KEY ?? ""
            });

            await client.createWebhookEndpoint({ url:
            "https://example.com/webhooks/ledger", enabledEvents:
            ["subscription.created", "balance.low"] });
components:
  schemas:
    CreateWebhookEndpointInput:
      type: object
      properties:
        url:
          type: string
          minLength: 1
          maxLength: 2048
          description: >-
            Where Ledger sends events. Live and production endpoints must be
            public `https://` URLs.
          example: https://example.com/webhooks/ledger
        enabledEvents:
          type: array
          items:
            type: string
            enum:
              - '*'
              - customer.created
              - customer.deleted
              - subscription.created
              - subscription.updated
              - subscription.canceled
              - invoice.paid
              - credits.granted
              - balance.low
              - balance.depleted
              - checkout.completed
              - checkout.expired
            description: An event type, or `*` for every event.
          minItems: 1
          maxItems: 50
        description:
          type: string
          nullable: true
          maxLength: 200
      required:
        - url
        - enabledEvents
    CreatedWebhookEndpoint:
      allOf:
        - $ref: '#/components/schemas/WebhookEndpoint'
        - type: object
          properties:
            secret:
              type: string
              description: >-
                The signing secret (`whsec_…`). Returned only here; store it to
                verify the Ledger-Signature header.
          required:
            - secret
    WebhookError:
      type: object
      properties:
        error:
          type: string
      required:
        - error
    WebhookEndpoint:
      type: object
      properties:
        object:
          type: string
          enum:
            - webhook_endpoint
        id:
          type: string
        url:
          type: string
        description:
          type: string
          nullable: true
        enabledEvents:
          type: array
          items:
            type: string
        apiVersion:
          type: string
        status:
          type: string
          enum:
            - enabled
            - disabled
        disabledReason:
          type: string
          nullable: true
          enum:
            - failing
            - manual
            - null
        disabledAt:
          type: string
          nullable: true
        failingSince:
          type: string
          nullable: true
        livemode:
          type: boolean
        environment:
          $ref: '#/components/schemas/WebhookEnvironment'
        createdAt:
          type: string
        updatedAt:
          type: string
      required:
        - object
        - id
        - url
        - description
        - enabledEvents
        - apiVersion
        - status
        - disabledReason
        - disabledAt
        - failingSince
        - livemode
        - environment
        - createdAt
        - updatedAt
    PayloadTooLargeError:
      type: object
      properties:
        error:
          type: string
          example: payload_too_large
      required:
        - error
    RateLimitError:
      type: object
      properties:
        error:
          type: string
          example: rate_limited
      required:
        - error
    WebhookEnvironment:
      type: string
      enum:
        - sandbox
        - live
  responses:
    PayloadTooLarge:
      description: 'The request body is over the limit: 1 MiB, or 5 MiB for a webhook.'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PayloadTooLargeError'
    RateLimited:
      description: >-
        Too many requests. Wait Retry-After seconds, then retry. See the rate
        limits guide.
      headers:
        Retry-After:
          description: Seconds until a request is allowed again
          schema:
            type: integer
        RateLimit-Limit:
          description: 'The burst: requests allowed at once'
          schema:
            type: integer
        RateLimit-Remaining:
          description: Requests left right now
          schema:
            type: integer
        RateLimit-Reset:
          description: Seconds until the full burst is back
          schema:
            type: integer
        RateLimit-Policy:
          description: >-
            The sustained rate per second and the burst, such as
            200;w=1;burst=1000
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RateLimitError'
  securitySchemes:
    ApiKey:
      type: http
      scheme: bearer

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.