> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quantumapi.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook

> Registers a URL to receive webhook events. The HMAC signing secret
is returned only in the creation response — store it securely.
Payloads are signed with HMAC-SHA256 and delivered in the
X-Webhook-Signature header.




## OpenAPI

````yaml POST /webhooks
openapi: 3.1.0
info:
  title: Qustody API
  description: >
    Non-custodial custody and orchestration API for Quantum Chain (post-quantum
    blockchain).

    Provides Fireblocks-like operating model for institutional integrators:

    multi-tenant vault/wallet management, transaction lifecycle with policy
    enforcement,

    external (callback-based) signing, webhook-driven event delivery, and full
    audit trail.
  version: 1.0.0
  contact:
    name: Quantum Chain Platform Team
  license:
    name: LGPL-3.0-or-later
servers:
  - url: '{baseUrl}/v1'
    description: Qustody API
    variables:
      baseUrl:
        default: https://api.qustody.io
security:
  - BearerAPIKey: []
tags:
  - name: health
    description: Liveness and readiness probes
  - name: tenants
    description: Tenant (integrator) management
  - name: vaults
    description: Vault (logical wallet grouping) management
  - name: wallets
    description: Wallet (on-chain address) registration and lookup
  - name: transactions
    description: Transaction lifecycle – create, sign, approve, reject, query
  - name: assets
    description: Supported asset registry
  - name: webhooks
    description: Webhook endpoint management
  - name: sso
    description: Single Sign-On (OIDC and SAML) authentication
  - name: tokens
    description: Token Management — Beta / Proposed.
paths:
  /webhooks:
    post:
      tags:
        - webhooks
      summary: Register a webhook endpoint
      description: |
        Registers a URL to receive webhook events. The HMAC signing secret
        is returned only in the creation response — store it securely.
        Payloads are signed with HMAC-SHA256 and delivered in the
        X-Webhook-Signature header.
      operationId: createWebhook
      parameters:
        - $ref: '#/components/parameters/idempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
      responses:
        '201':
          description: Webhook endpoint created (includes secret)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
components:
  parameters:
    idempotencyKey:
      name: Idempotency-Key
      in: header
      schema:
        type: string
      description: Idempotency key for safe retries (required for POST/PUT)
  schemas:
    CreateWebhookRequest:
      type: object
      required:
        - url
      properties:
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
          description: Event types to subscribe to (empty = all)
    WebhookEndpoint:
      type: object
      required:
        - id
        - tenantId
        - url
        - status
        - createdAt
      properties:
        id:
          type: string
          format: uuid
        tenantId:
          type: string
          format: uuid
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
            - ACTIVE
            - DISABLED
        secret:
          type: string
          description: Only returned on creation
        createdAt:
          type: string
          format: date-time
  securitySchemes:
    BearerAPIKey:
      type: http
      scheme: bearer
      description: 'API key authentication. Format: `Bearer {key_id}:{secret}`'

````