# Create webhook endpoint

Create a new webhook for the sponsor.

Only one webhook is allowed per sponsor. The secret is returned only on creation.
Store it securely - it cannot be retrieved later.

The secret is used to generate HMAC-SHA256 signatures for webhook payloads.

You can optionally specify which events to subscribe to. If not provided, the webhook
will receive all available event types.

Endpoint: POST /webhooks
Version: 0.29.6
Security: APIKeyHeader

## Request fields (application/json):

  - `url` (string, required)
    Webhook endpoint URL (must be HTTPS in production)

  - `events` (any)
    List of event types to subscribe to. If not provided, subscribes to all events.

## Response 201 fields (application/json):

  - `webhook_id` (string, required)
    Unique webhook identifier

  - `url` (string, required)
    Webhook endpoint URL

  - `secret` (string, required)
    HMAC secret key (only returned once!)

  - `events` (array, required)
    Subscribed event types

  - `created_at` (string, required)
    Creation timestamp

  - `message` (string)
    Success message

## Response 409 fields (application/json):

  - `error` (string, required)

  - `code` (integer, required)

  - `trace_id` (string, required)

## Response 422 fields (application/json):

  - `detail` (array)

  - `detail.loc` (array, required)

  - `detail.msg` (string, required)

  - `detail.type` (string, required)