> ## Documentation Index > Fetch the complete documentation index at: https://docs.hookie.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a destination for this customer ## OpenAPI ````yaml /openapi.json post /portal/api/destinations openapi: 3.1.0 info: title: Hookie API version: 1.0.0 summary: Capture, route and deliver webhooks. description: >- Hookie exposes three HTTP surfaces. **Ingest + streaming** is the public plane. A path-form endpoint URL authenticates by its own high-entropy slug — there is no key, token or cookie — and an `ik_live_…` ingest key authenticates the `/v1/*` routes. Whenever the URL names a dataset the payload is stored whole into it; project mapping rules are evaluated on exactly one shape, `POST /v1/ingest/{ingest_key}` with no dataset segment. **The customer portal API** is a separate, token-authed surface for your end customers, scoped to one portal and one customer. **The admin API** drives the console. It accepts either a browser session or an OAuth bearer token from a connected coding agent — the same routes, the same validation, the same audit trail. An agent's authority is its user's workspace role narrowed to the scopes granted in the console. This document is generated from the request handlers and adversarially verified against them. contact: name: Hookie url: https://hookie.ai license: name: Proprietary url: https://hookie.ai/legal/terms servers: - url: https://app.hookie.ai description: Production - url: https://app.preview.hookie.ai description: Preview security: [] tags: - name: Ingest description: Send events to Hookie. - name: Streaming description: Tail events in real time over SSE or WebSocket. - name: Portal description: Token-authed surface for your end customers. - name: Projects description: Projects and their settings. - name: Routing description: Rules, endpoints, datasets and records. - name: Delivery description: Destinations, deliveries and replay. - name: Workflows description: Multi-step workflows, triggers and AI agents. - name: Observability description: Search, correlation, stats and the audit log. - name: Workspace description: Members, connected agents, SSO and billing. paths: /portal/api/destinations: post: tags: - Customer Portal summary: Create a destination for this customer operationId: createPortalDestination parameters: - name: token in: query required: false description: >- Portal access token (hpt_…), as an alternative to the `Authorization: Bearer` header. schema: type: string requestBody: required: true description: >- Only `name`, `url` and `dataset_filter` are customer-settable. Every other column is server-controlled and cannot be influenced by the request: `secret` (generated, whsec_ + 48 hex, AES-GCM encrypted at rest), `enabled` (always 1 on create), `created_by` (always "portal:"), `tenant_id`, `project_id`, `portal_id`, `customer_id` (all taken from the token), `event_filter` (never set) and `created_at`. Unknown properties in the body are ignored, not rejected. content: application/json: schema: type: object required: - name - url additionalProperties: true properties: name: type: string minLength: 1 description: Must be a non-empty string after trimming; stored trimmed. url: type: string format: uri pattern: ^[Hh][Tt][Tt][Pp][Ss]:// description: >- Must start with https:// (case-insensitive). No further URL validation is performed and the value is stored verbatim (not trimmed). dataset_filter: type: array items: type: string description: >- Optional subset of the portal's exposed event types. Non-string entries are dropped before validation. Every remaining entry must appear in the portal's event_types or the request is rejected. If omitted or empty: defaults to the portal's full event_types list, or null (all datasets) when the portal exposes none. example: name: Prod receiver url: https://hooks.acme.test/in dataset_filter: - orders responses: '201': description: >- Created. The signing secret is returned once and never again — the stored copy is encrypted. content: application/json: schema: type: object required: - id - signing_secret properties: id: type: string description: New destination id (UUID). signing_secret: type: string description: >- HMAC signing secret, "whsec_" followed by 48 lowercase hex characters. Shown once. example: id: 9c1f… signing_secret: whsec_0a1b… '400': description: >- Validation failure. `error` is one of: "name is required" (body absent, not a JSON object, or name missing/blank — an unparseable body also lands here), "url must be https", or "dataset(s) not exposed by this portal: ". content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- Missing, malformed, revoked, expired token, or the portal is disabled. content: application/json: schema: $ref: '#/components/schemas/Error' security: - portalTokenHeader: [] - portalTokenQuery: [] components: schemas: Error: type: object required: - error properties: error: type: string description: Human-readable reason. retry_after: type: integer description: Seconds to wait. Present on 429. upgrade_url: type: string format: uri description: Present only on a monthly-quota 429. securitySchemes: portalTokenHeader: type: http scheme: bearer description: >- A `hpt_…` customer portal token, as `Authorization: Bearer`. Stored hashed; shown once at issue. portalTokenQuery: type: apiKey in: query name: token description: >- The same portal token in the query string, for embedding the portal in an iframe where a header cannot be set. ````