Sign inGet Started

Create a webhook endpoint

POST
/v1/webhooks
const created = await bird.webhooks.create({
  url: "https://acme.com/hooks/bird",
  events: ["email.delivered", "email.bounced"],
  description: "Delivery pipeline",
});
console.log(created.id, created.secret);
Response201
{
  "id": "whk_01krdgeqcxet5s7t44vh8rt9mg",
  "url": "https://example.com/webhook",
  "description": "Production webhook endpoint",
  "filter": null,
  "events": [
    "email.delivered",
    "email.bounced"
  ],
  "status": "active",
  "destination": {
    "type": "webhook"
  },
  "created_at": "2026-05-20T09:14:52Z",
  "updated_at": "2026-05-25T16:42:01Z",
  "secret": "whsec_base64encodedvalue"
}

Registers an active webhook endpoint that receives the event types in events as signed HTTPS POST requests. See the webhooks guide for delivery, signing, and retry behavior.

The 201 response is the only response that includes the signing secret (whsec_ prefix). Store it immediately; if it is lost, rotate the signing secret.

A non-HTTPS or non-public url, an unknown event type, or exceeding the organization's endpoint limit returns 422.

Request Payload

url
string

HTTPS URL to deliver events to, at most 2048 characters. The host must be publicly reachable: URLs on private, loopback, or link-local addresses are rejected with a 422. Required unless destination is a connector, whose URL comes from the connector and its config; a URL given with one must equal it.

filter
object

Limit delivery to one mailbox and only email_mailbox events. Omit to include all resources.

Show child parameters
filter.mailbox_id
string
required

Mailbox to receive events for. Must belong to this workspace; a mailbox outside it returns 422.

events
array of string
required

Event types to subscribe to; the endpoint receives only matching events. Types outside the event catalog return a 422, and an endpoint holds at most 100 entries.

description
string

Human-readable label for this endpoint, up to 256 characters.

destination
object

How each delivery is built. Omit to post the signed event to url unchanged, the same as {"type": "webhook"}.

Show child parameters

Posts the signed event to the endpoint's url unchanged.

destination.type
string
required

Value: webhook

Response Payload

id
string
required

Unique identifier for the endpoint (whk_ prefix). Accepted as webhook_id by every /v1/webhooks/{webhook_id} operation.

url
string
required

HTTPS URL where the API delivers events for this endpoint.

description
string

Human-readable label for the endpoint.

filter
nullable object
required

Mailbox scope configured through filter, or null.

Show child attributes
filter.mailbox_id
string
required

Mailbox to receive events for. Must belong to this workspace; a mailbox outside it returns 422.

events
array of string
required

Event types this endpoint is subscribed to; only matching events are delivered. Change the set with Update a webhook endpoint.

status
string
required

Delivery state of the endpoint.

  • active: The initial state; events are being delivered normally.
  • degraded: Recent deliveries are failing. We keep delivering and retrying, and the endpoint returns to active automatically once deliveries succeed again.
  • paused: All delivery is stopped, either because an update set status to paused or automatically after sustained delivery failures. A paused endpoint never resumes on its own: re-enable it with Update a webhook endpoint, then Replay failed deliveries to recover the deliveries that failed before the pause. Events that arrived while it was paused were never attempted, so a replay does not reach them.

Possible values: active, degraded, paused

destination
object

How each delivery to the endpoint is built.

Show child attributes

Posts the signed event to the endpoint's url unchanged.

destination.type
string
required

Value: webhook

created_at
string
required
updated_at
string
required
secret
string
required

Signing secret for this endpoint (whsec_ prefix), used to verify every delivery signature. Present in this response only: store it immediately, it cannot be retrieved again. If you lose it, mint a new one with Rotate webhook signing secret.