Agent-readable docs index: /llms.txt. Full docs in one file: /llms-full.txt. Download /docs.zip to grep all markdown files locally.

Create Webhook

Register a webhook destination for sandbox lifecycle events. See Webhooks.
body urlstringrequired
HTTPS endpoint to deliver to. (SSRF protection is applied by the delivery provider at send time, not at registration.)
body eventTypesstring[]
Event-type allow-list — exact (sandbox.stopped) or prefix (sandbox.*). Default: all event types. Types outside the sandbox taxonomy are rejected with 400.
body sandboxIdstring
Scope to a single sandbox. Omit to receive events for all of the org's sandboxes.
body secretstring
Signing secret. Omit and one is generated (whsec_…). The secret is returned in the create response and is re-fetchable any time via GET /api/webhooks/{id}/secret.
body namestring
Optional display name for the destination.
body enabledboolean
Whether the destination is active. Default true. false pauses delivery.
header Idempotency-Keystring
Optional. A retried create with the same key and same body returns the same destination (200) instead of a duplicate. Reusing the key with a different body is a 409 conflict.
Without an Idempotency-Key, each call creates a new destination and returns 201 — there is no get-or-create by name. With one, a retried call returns the same destination with 200.
Validation (all 400): url must be HTTPS; each eventTypes entry must be a known sandbox event type or a prefix.* wildcard.
Response example
{
  "id": "whk_3f9a2c",
  "name": "prod",
  "url": "https://app.example.com/oc-webhook",
  "eventTypes": ["sandbox.stopped"],
  "sandboxId": null,
  "enabled": true,
  "hasSecret": true,
  "secret": "whsec_Hk9…",
  "createdAt": "2026-06-24T12:00:00Z",
  "updatedAt": "2026-06-24T12:00:00Z"
}