Skip to content
The Desk

Create a webhook subscription

POST
/webhooks
curl --request POST \
  --url https://desk.example.com/api/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "Deploy bot", "url": "https://hooks.example.com/the-desk", "events": [ "message.created" ], "channel_ids": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ] }'

Required scope: webhooks:write

Registers an outgoing-webhook subscription in the workspace. The signing secret is returned in plaintext here exactly once and never again — store it now; it is what you verify delivery signatures with.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required
string
<= 255 characters
url
required

A publicly reachable http:// or https:// endpoint. Loopback, private, link-local, and cloud-metadata addresses are rejected.

string format: uri
<= 2048 characters
events
required
Array<string>
>= 1 items
Allowed values: message.created message.updated message.deleted reaction.added channel.member_added
channel_ids

Restrict delivery to these channels, all of which must belong to the workspace. Omit to subscribe workspace-wide.

Array<string> | null

Responses

Section titled “Responses”

201

Section titled “201”

The subscription was created, with its one-time signing secret.

Media typeapplication/json
object
data
required

An outgoing-webhook subscription. The signing secret is deliberately absent — it is returned only by the create operation.

object
id
required
string format: uuid
name
required
string
url
required
string format: uri
events
required
Array<string>
Allowed values: message.created message.updated message.deleted reaction.added channel.member_added
channel_ids
required

Null when the subscription is workspace-wide.

Array<string> | null
status
required

A subscription is disabled automatically after repeated delivery failures.

string
Allowed values: active disabled
consecutive_failures
required
integer
last_success_at
required
string | null format: date-time
disabled_at
required
string | null format: date-time
created_at
required
string | null format: date-time
secret
required

The signing secret, shown only here.

string
Example
{
  "data": {
    "events": [
      "message.created"
    ],
    "status": "active"
  }
}

401

Section titled “401”

The token is missing, malformed, or revoked.

Media typeapplication/json

The shape every error response carries.

object
message
required
string
Examplegenerated
{
  "message": "example"
}

403

Section titled “403”

The token lacks the scope this operation requires, or its subject may see the resource but not perform this action on it.

Media typeapplication/json

The shape every error response carries.

object
message
required
string
Examplegenerated
{
  "message": "example"
}

404

Section titled “404”

The resource does not exist, is outside the token’s workspace, or the integrations platform is disabled. A channel the subject cannot see is reported here rather than as a 403, so the API never leaks its existence.

Media typeapplication/json

The shape every error response carries.

object
message
required
string
Examplegenerated
{
  "message": "example"
}

422

Section titled “422”

The request body failed validation.

Media typeapplication/json
object
message
required
string
errors
required

The failing fields, each mapped to its messages.

object
key
additional properties
Array<string>
Examplegenerated
{
  "message": "example",
  "errors": {
    "additionalProperty": [
      "example"
    ]
  }
}

429

Section titled “429”

The per-token rate limit (INTEGRATIONS_API_RATE_LIMIT requests per minute) was exceeded. Retry after the Retry-After header.

Media typeapplication/json

The shape every error response carries.

object
message
required
string
Examplegenerated
{
  "message": "example"
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before retrying.