> ## Documentation Index > Fetch the complete documentation index at: https://docs.hookie.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook endpoint > Top-level alias: POST /admin/api/webhooks. Write role required. The cap is checked before validation, so a full project returns 402 even for an invalid body. ## OpenAPI ````yaml /openapi.json post /admin/api/projects/{pid}/webhooks openapi: 3.1.0 info: title: Hookie API version: 1.0.0 summary: Capture, route and deliver webhooks. description: >- Hookie exposes three HTTP surfaces. **Ingest + streaming** is the public plane. A path-form endpoint URL authenticates by its own high-entropy slug — there is no key, token or cookie — and an `ik_live_…` ingest key authenticates the `/v1/*` routes. Whenever the URL names a dataset the payload is stored whole into it; project mapping rules are evaluated on exactly one shape, `POST /v1/ingest/{ingest_key}` with no dataset segment. **The customer portal API** is a separate, token-authed surface for your end customers, scoped to one portal and one customer. **The admin API** drives the console. It accepts either a browser session or an OAuth bearer token from a connected coding agent — the same routes, the same validation, the same audit trail. An agent's authority is its user's workspace role narrowed to the scopes granted in the console. This document is generated from the request handlers and adversarially verified against them. contact: name: Hookie url: https://hookie.ai license: name: Proprietary url: https://hookie.ai/legal/terms servers: - url: https://app.hookie.ai description: Production - url: https://app.preview.hookie.ai description: Preview security: [] tags: - name: Ingest description: Send events to Hookie. - name: Streaming description: Tail events in real time over SSE or WebSocket. - name: Portal description: Token-authed surface for your end customers. - name: Projects description: Projects and their settings. - name: Routing description: Rules, endpoints, datasets and records. - name: Delivery description: Destinations, deliveries and replay. - name: Workflows description: Multi-step workflows, triggers and AI agents. - name: Observability description: Search, correlation, stats and the audit log. - name: Workspace description: Members, connected agents, SSO and billing. paths: /admin/api/projects/{pid}/webhooks: post: tags: - Webhooks summary: Create a webhook endpoint description: >- Top-level alias: POST /admin/api/webhooks. Write role required. The cap is checked before validation, so a full project returns 402 even for an invalid body. operationId: createWebhook parameters: - name: pid in: path required: true description: Project id (UUID) belonging to the caller workspace. schema: type: string requestBody: required: true content: application/json: schema: type: object required: - name - slug - dataset properties: name: type: string minLength: 1 maxLength: 80 slug: type: string pattern: ^[a-z0-9][a-z0-9-]{0,46}$ description: >- The base slug (lowercase letters, digits and hyphens, max 47 characters). This is NOT the public URL - a separate high-entropy slug is generated and returned as webhook_slug. dataset: type: string pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ enabled: type: boolean default: true description: Anything other than the literal false is treated as true. criteria: type: array maxItems: 10 description: >- Omitted or empty accepts any payload (the URL already scopes it). The validator rejects more than 10 entries before the documented 20-criteria ceiling can apply. items: type: object required: - path - equals properties: path: type: string maxLength: 200 description: >- Payload field path; no whitespace, no leading dot, no $-special paths. equals: type: string maxLength: 500 mappings: type: array maxItems: 50 description: Omitted or empty means identity - store the whole payload. items: type: object required: - path - key properties: path: type: string maxLength: 200 description: >- Payload field path, or $payload, $submission.id, $submission.received_at. key: type: string pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ responses: '201': description: >- Created at version 1, with a mirror mapping rule synced behind it. webhook_slug is the public URL credential and is the only place it is returned in full at creation time. content: application/json: schema: type: object required: - id - slug - webhook_slug properties: id: type: string slug: type: string description: Versioned route slug, base-v1. webhook_slug: type: string description: High-entropy public slug - treat as a secret. '400': description: >- Validation failure - name, slug pattern, dataset identifier, criteria or mappings. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- Not signed in, or the agent bearer token is invalid, unknown or revoked. content: application/json: schema: $ref: '#/components/schemas/Error' '402': description: Plan limit reached (10 webhooks per project). content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Insufficient role (write capability required: owner, admin or developer), or a cookie-authenticated mutation missing the X-Requested-With: fetch header. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: A webhook with that slug already exists. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error. content: application/json: schema: $ref: '#/components/schemas/Error' security: - session: [] - bearerAuth: [] components: schemas: Error: type: object required: - error properties: error: type: string description: Human-readable reason. retry_after: type: integer description: Seconds to wait. Present on 429. upgrade_url: type: string format: uri description: Present only on a monthly-quota 429. securitySchemes: session: type: apiKey in: cookie name: hookie_session description: >- The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the `X-Requested-With` CSRF header. bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- An OAuth 2.1 access token from a connected agent, audienced at the `/mcp` resource URI. The agent acts as its user, with that user's role narrowed to the granted `hookie:*` scopes. No CSRF header is required — a bearer token is not ambient credentials. ````