webhooks.create

Add a webhook endpoint for a shop (owner or office). Returns the signing secret once; it is never shown again.


Who	A person's own sign-in only (agent tokens are refused)
REST	`POST /v1/webhooks`
MCP tool	Not an MCP tool
Writes	yes, send an Idempotency-Key
Area	Developers and platforms

When to use it

Agents can't call this. A developer adds an endpoint with their own sign-in.

What to tell the owner

Nothing to explain.

Input

Field	Type	Required
`shop_id`	string	yes
`url`	string	yes
`events`	array	no

Example

POST https://doingwork.work/v1/webhooks
content-type: application/json
Idempotency-Key: 3f1c...

{
  "shop_id": "00000000-0000-4000-8000-000000000000",
  "url": "https://example.com/hooks/doing-work"
}

Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are {code, message, status}.

Errors

Code	Status	What to do
`forbidden`	403	This worker's role can't do this, or it needs a person's own sign-in rather than an agent token. Tell the person who can.
`invalid_input`	400	A field is missing, the wrong type, or unknown. The message names the field. Fix the input; don't retry as is.
`invalid_input`, `invalid_token`, `rate_limited`		Can happen on any call. See errors.