---
title: webhooks.create | Doing Work API
description: Add a webhook endpoint for a shop (owner or office). Returns the signing secret once; it is never shown again.
url: https://doingwork.work/docs/reference/webhooks-create/
---

# webhooks.create

Add a webhook endpoint for a shop (owner or office). Returns the signing secret once; it is never shown again.

|  |  |
|---|---|
| Who | A person's own sign-in only (agent tokens are refused) |
| REST | `POST /v1/webhooks` |
| MCP tool | Not an MCP tool |
| Writes | yes, send an Idempotency-Key |
| Area | [Developers and platforms](https://doingwork.work/docs/reference/#developers-and-platforms) |

## When to use it

Agents can't call this. A developer adds an endpoint with their own sign-in.

## What to tell the owner

Nothing to explain.

## Input

| Field | Type | Required |
|---|---|---|
| `shop_id` | string | yes |
| `url` | string | yes |
| `events` | array | no |

## Example

```http
POST https://doingwork.work/v1/webhooks
content-type: application/json
Idempotency-Key: 3f1c...

{
  "shop_id": "00000000-0000-4000-8000-000000000000",
  "url": "https://example.com/hooks/doing-work"
}
```

## Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are `{code, message, status}`.

## Errors

| Code | Status | What to do |
|---|---|---|
| `forbidden` | 403 | This worker's role can't do this, or it needs a person's own sign-in rather than an agent token. Tell the person who can. |
| `invalid_input` | 400 | A field is missing, the wrong type, or unknown. The message names the field. Fix the input; don't retry as is. |
| `invalid_input`, `invalid_token`, `rate_limited` |  | Can happen on any call. See [errors](https://doingwork.work/docs/errors/). |