> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getsales.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook

> Subscribe an https endpoint to platform events: the server mints a 32-hex secret and returns it in this response ONLY (masked afterwards); the receiver verifies X-Webhook-Signature with it. target_url must be https on a public host, unique per team (409 duplicate_rejected); events is an exact list of catalog types (no wildcard); filters.account_sid narrows to one sending identity. Every producing service delivers through this one subscription.

Contract:
- MCP tool `create_webhook`, registry package `mcp.integrations/webhooks`, mount `integrations.webhooks`.
- Operation `create`, response envelope `create`.
- Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.



## OpenAPI

````yaml /api-reference/integrations/openapi.yaml post /api/webhooks
openapi: 3.0.3
info:
  title: 'GetSales public contract: gs.service.integrations'
  description: >-
    The integrations service: the integration platform (the team's credentials
    for its own APIs and its CRM grants, the HTTP tools it defines over them,
    the execution log and the priced catalog of every outbound provider call)
    and the event plane (the platform-wide webhook subscriptions and the
    delivery state of each event).


    GENERATED. This document is projected from the Zod MCP tool registry in
    `product/mcp/gs.mcp` (one tool per public endpoint, 1:1). Do not edit it by
    hand; edit the tool definition and regenerate with `pnpm openapi:public`.


    Surface: the public `/api` contract of `gs.service.integrations`, 26
    operations. This is the only OpenAPI document the platform publishes.
    Internal (`/internal`) and health endpoints are deliberately absent: they
    are not part of any contract, they can change without notice, and the
    service source is their only description.


    Conventions:

    - Auth is a bearer JWT, optionally narrowed by the `Team-SID` header.

    - Every success body is an MCP envelope: `success: true` plus one typed
    `operation` shape (`search`, `get`, `create`, `update`, `delete`, `metrics`,
    `group_by`, `action`), and a `meta` block with `trace_id` for support.

    - Every failure is the same `McpError` envelope with a code from a fixed
    16-code taxonomy, so a client maps errors once.

    - Lists page with `page_size` (0 to 500, default 50) plus an opaque forward
    `cursor`; `page_size: 0` returns counts only.

    - On `GET` and `DELETE`, object-valued query parameters (`filter`, `sort`)
    travel as JSON text and array-valued ones repeat as `name[]=value`.

    - The MCP-only `_meta` field (usage analytics) never reaches the backend and
    is not part of this contract.
  version: '1.0'
  contact:
    name: GetSales
    url: https://getsales.io
    email: support@getsales.io
  license:
    name: Proprietary
    url: https://getsales.io/terms
servers:
  - url: https://beta.getsales.io/integrations/v1
    description: >-
      Production (the gateway path on the beta ring; the origin is provisioned
      per DEPLOY_MAP.md)
security:
  - BearerJwt: []
    TeamSid: []
tags:
  - name: custom_tools
    description: >-
      Registry package `mcp.integrations/custom_tools`, served on MCP mount
      `integrations.providers`.
  - name: provider_calls
    description: >-
      Registry package `mcp.integrations/provider_calls`, served on MCP mount
      `integrations.providers`.
  - name: provider_connections
    description: >-
      Registry package `mcp.integrations/provider_connections`, served on MCP
      mount `integrations.providers`.
  - name: webhook_logs
    description: >-
      Registry package `mcp.integrations/webhook_logs`, served on MCP mount
      `integrations.webhooks`.
  - name: webhooks
    description: >-
      Registry package `mcp.integrations/webhooks`, served on MCP mount
      `integrations.webhooks`.
paths:
  /api/webhooks:
    post:
      tags:
        - webhooks
      summary: Create webhook
      description: >-
        Subscribe an https endpoint to platform events: the server mints a
        32-hex secret and returns it in this response ONLY (masked afterwards);
        the receiver verifies X-Webhook-Signature with it. target_url must be
        https on a public host, unique per team (409 duplicate_rejected); events
        is an exact list of catalog types (no wildcard); filters.account_sid
        narrows to one sending identity. Every producing service delivers
        through this one subscription.


        Contract:

        - MCP tool `create_webhook`, registry package
        `mcp.integrations/webhooks`, mount `integrations.webhooks`.

        - Operation `create`, response envelope `create`.

        - Flags: dangerous: the MCP layer gates it behind a preview/commit
        token, and the effect cannot be undone through this API.
      operationId: create_webhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
      responses:
        '200':
          description: '`create` success envelope.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateWebhookResponse'
        4XX:
          $ref: '#/components/responses/McpClientError'
        5XX:
          $ref: '#/components/responses/McpServerError'
components:
  schemas:
    CreateWebhookRequest:
      type: object
      description: Request body of `create_webhook`.
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
          description: Free text, 1..255 chars.
        target_url:
          type: string
          maxLength: 2048
          description: https only, a public host (no private or local address).
        events:
          type: array
          items:
            type: string
            enum:
              - data-sources.completed
              - data-sources.failed
              - data-sources.paused
              - data-sources.deleted
              - playtable-runs.finished
              - playtable-runs.cancelled
              - workflows.published
              - workflow-records.entered
              - workflow-records.completed
              - workflow-records.failed
              - workflow-records.exited
              - workflow-records.paused
              - workflow-records.resumed
              - messages.sent
              - messages.received
              - messages.bounced
              - conversations.created
              - conversations.state-changed
              - conversations.scenario-changed
              - conversations.merged
              - conversations.person-linked
              - conversations.person-unlinked
              - conversations.signals-changed
              - tasks.created
              - tasks.completed
              - sender-profiles.created
              - sender-profiles.deleted
              - sender-profiles.health-changed
              - agents.mode-changed
              - signals.website-visited
              - website-sites.broken
              - website-sites.recovered
              - webhooks.failed
          minItems: 1
          description: At least one catalog event type; exact membership.
        filters:
          type: object
          properties:
            account_sid:
              type: string
              nullable: true
              minLength: 18
              maxLength: 18
              description: >-
                Deliver only the events of this sending identity (18 chars, e.g.
                a sender profile ub_sp_...); null = no narrowing.
          description: Optional narrowing by sending identity.
      required:
        - name
        - target_url
        - events
    CreateWebhookResponse:
      type: object
      properties:
        success:
          type: boolean
          enum:
            - true
        operation:
          type: string
          enum:
            - create
        item:
          type: object
          properties:
            sid:
              type: string
              description: Webhook sid (wh_hk_...).
            team_sid:
              type: string
              description: The subscribing workspace (ts_tm_...).
            name:
              type: string
              description: Free text, 1..255 chars.
            target_url:
              type: string
              description: >-
                The https endpoint events are POSTed to; one subscription per
                team per URL.
            events:
              type: array
              items:
                type: string
              description: >-
                The subscribed event types (WebhookEventTypeEnum values), exact
                membership.
            filters:
              type: object
              nullable: true
              properties:
                account_sid:
                  type: string
                  nullable: true
                  minLength: 18
                  maxLength: 18
                  description: >-
                    Deliver only the events of this sending identity (18 chars,
                    e.g. a sender profile ub_sp_...); null = no narrowing.
              description: >-
                The narrowing by sending identity; null or {} = every subscribed
                event.
            secret:
              type: string
              nullable: true
              description: >-
                The 32-hex HMAC secret: in the create response only, null on
                every other read.
            status:
              type: string
              enum:
                - 'on'
                - 'off'
                - failed
              description: >-
                on; off (switched off by hand); failed (20 failed deliveries in
                a row or one 410: revive with update status on).
            consecutive_failed_attempts:
              type: integer
              description: >-
                Failed deliveries in a row, driven by the log; 20 trips the
                auto-disable.
            last_failure_at:
              type: string
              nullable: true
              description: ISO 8601 UTC of the most recent failed delivery.
            created_by:
              type: object
              properties:
                actor_type:
                  type: string
                  enum:
                    - user
                    - support
                    - api_key
                    - system
                    - agent
                actor_sid:
                  type: string
                  nullable: true
                team_sid:
                  type: string
                actor_name:
                  type: string
                  nullable: true
                  description: >-
                    The OAuth client that acted ("Claude", "n8n"); null for a
                    user, an API key or a system job.
                oauth_client_sid:
                  type: string
                  nullable: true
                  description: The acting OAuth client (id_oc_*); null off the OAuth path.
                reason:
                  type: string
                  nullable: true
                  description: >-
                    Why a system actor wrote the row (snapshot_capture_job,
                    ...); null otherwise.
                permissions:
                  type: object
                  additionalProperties: {}
                  description: >-
                    Internal audit context: the grant set the actor held at
                    write time. Not a contract.
                cluster_id:
                  type: integer
                  nullable: true
                  description: 'Internal audit context: the cluster that served the write.'
                trace_id:
                  type: string
                  nullable: true
                  description: >-
                    Internal audit context: the trace id of the request that
                    wrote the row.
              required:
                - actor_type
                - actor_sid
                - team_sid
                - permissions
              description: Who subscribed.
            deleted_by:
              type: object
              nullable: true
              properties:
                actor_type:
                  type: string
                  enum:
                    - user
                    - support
                    - api_key
                    - system
                    - agent
                actor_sid:
                  type: string
                  nullable: true
                team_sid:
                  type: string
                actor_name:
                  type: string
                  nullable: true
                  description: >-
                    The OAuth client that acted ("Claude", "n8n"); null for a
                    user, an API key or a system job.
                oauth_client_sid:
                  type: string
                  nullable: true
                  description: The acting OAuth client (id_oc_*); null off the OAuth path.
                reason:
                  type: string
                  nullable: true
                  description: >-
                    Why a system actor wrote the row (snapshot_capture_job,
                    ...); null otherwise.
                permissions:
                  type: object
                  additionalProperties: {}
                  description: >-
                    Internal audit context: the grant set the actor held at
                    write time. Not a contract.
                cluster_id:
                  type: integer
                  nullable: true
                  description: 'Internal audit context: the cluster that served the write.'
                trace_id:
                  type: string
                  nullable: true
                  description: >-
                    Internal audit context: the trace id of the request that
                    wrote the row.
              required:
                - actor_type
                - actor_sid
                - team_sid
                - permissions
              description: Who deleted it; null while live.
            created_at:
              type: string
              description: ISO 8601 UTC.
            updated_at:
              type: string
              description: ISO 8601 UTC.
            deleted_at:
              type: string
              nullable: true
              description: ISO 8601 UTC; null = live.
          required:
            - sid
            - team_sid
            - name
            - target_url
            - events
            - filters
            - status
            - consecutive_failed_attempts
            - last_failure_at
            - created_by
            - deleted_by
            - created_at
            - updated_at
            - deleted_at
        already_exists:
          type: boolean
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type: string
              nullable: true
              description: >-
                The team this call ran in (the token team, or the team_sid
                override). Null when unauthenticated; absent from pre-2026-08-20
                backends.
            actor_type:
              type: string
              nullable: true
              description: >-
                user | agent | api_key | system. Null when unauthenticated;
                absent from pre-2026-08-20 backends.
          required:
            - trace_id
            - span_id
            - timestamp
            - duration_ms
      required:
        - success
        - operation
        - item
        - already_exists
        - meta
    McpError:
      type: object
      properties:
        success:
          type: boolean
          enum:
            - false
        error:
          type: object
          properties:
            code:
              type: string
              enum:
                - validation_failed
                - nothing_to_update
                - not_found
                - relation_not_found
                - invalid_transition
                - limit_exceeded
                - payment_required
                - duplicate_rejected
                - conflict
                - delete_blocked
                - unauthorized
                - forbidden
                - rate_limited
                - internal_error
                - service_unavailable
                - not_implemented
            message:
              type: string
            recoverable:
              type: boolean
            suggestion:
              type: string
            field_errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: object
                  properties:
                    rule:
                      type: string
                    message:
                      type: string
                  required:
                    - rule
                    - message
            blockers:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: >-
                      Machine-readable blocker type (active_flow, pending_tasks,
                      …).
                  severity:
                    type: string
                    enum:
                      - hard
                      - soft
                    description: >-
                      hard = external action required; soft = acknowledge is
                      enough.
                  description:
                    type: string
                  entity_sid:
                    type: string
                    nullable: true
                  count:
                    type: integer
                  resolution:
                    type: string
                    description: 'Hard: tool name to call. Soft: code for acknowledge[].'
                  resolution_hint:
                    type: string
                required:
                  - type
                  - severity
                  - description
                  - entity_sid
                  - resolution
                  - resolution_hint
            context:
              type: object
              additionalProperties: {}
          required:
            - code
            - message
            - recoverable
        meta:
          type: object
          properties:
            trace_id:
              type: string
              description: UUID v7; same 128-bit value as the X-Trace-Id header.
            span_id:
              type: string
              pattern: ^[0-9a-f]{16}$
              description: 16 hex chars, root span of this request.
            timestamp:
              type: string
              description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
            duration_ms:
              type: integer
              minimum: 0
              description: Server-side wall clock.
            team_sid:
              type: string
              nullable: true
              description: >-
                The team this call ran in (the token team, or the team_sid
                override). Null when unauthenticated; absent from pre-2026-08-20
                backends.
            actor_type:
              type: string
              nullable: true
              description: >-
                user | agent | api_key | system. Null when unauthenticated;
                absent from pre-2026-08-20 backends.
          required:
            - trace_id
            - span_id
            - timestamp
            - duration_ms
      required:
        - success
        - error
  responses:
    McpClientError:
      description: >-
        MCP error envelope. `error.code` is one of validation_failed,
        nothing_to_update, not_found, relation_not_found, invalid_transition,
        limit_exceeded, payment_required, duplicate_rejected, conflict,
        delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
    McpServerError:
      description: >-
        MCP error envelope with `error.code` internal_error or
        service_unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/McpError'
  securitySchemes:
    BearerJwt:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Access token issued by gs.service.id. Its `access_identity` claim
        carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is
        authoritative.
    TeamSid:
      type: apiKey
      in: header
      name: Team-SID
      description: >-
        Team scope for tokens that do not carry one. Ignored when the token
        already names a team.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.