> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create

> Register a webhook endpoint for one or more event types. The response carries the signing secret exactly once — verify each delivery's korve-signature header against it.



## OpenAPI

````yaml /openapi.json post /v1/orgs/{orgId}/webhooks
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/orgs/{orgId}/webhooks:
    post:
      tags:
        - webhooks
      summary: Create
      description: >-
        Register a webhook endpoint for one or more event types. The response
        carries the signing secret exactly once — verify each delivery's
        korve-signature header against it.
      operationId: webhooks.create
      parameters:
        - name: orgId
          in: path
          required: true
          schema:
            type: string
          description: The organization's id (UUID) or slug — either form is accepted.
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                  description: >-
                    HTTPS endpoint to deliver events to, e.g.
                    "https://hooks.acme.com/korve". Plain http is refused.
                events:
                  type: array
                  items:
                    type: string
                    enum:
                      - deploy.failed
                      - budget.alert
                      - budget.exceeded
                    description: >-
                      Platform event type: deploy.failed (a deployment failed),
                      budget.alert (a project passed its budget alert
                      threshold), budget.exceeded (a project reached its monthly
                      budget cap).
                  description: >-
                    Event types to deliver. At least one; duplicates are
                    ignored.
              required:
                - url
                - events
      responses:
        '201':
          description: >-
            Webhook registered. `secret` is the signing secret — shown exactly
            once; store it securely.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  url:
                    type: string
                    description: >-
                      HTTPS endpoint events are POSTed to. Unique per
                      organization.
                  events:
                    type: array
                    items:
                      type: string
                      enum:
                        - deploy.failed
                        - budget.alert
                        - budget.exceeded
                      description: >-
                        Platform event type: deploy.failed (a deployment
                        failed), budget.alert (a project passed its budget alert
                        threshold), budget.exceeded (a project reached its
                        monthly budget cap).
                    description: >-
                      Event types delivered to this endpoint, in canonical
                      order.
                  createdAt:
                    type: string
                    format: date-time
                  secret:
                    type: string
                    pattern: ^whsec_[0-9a-f]{40}$
                    description: >-
                      The signing secret deliveries are HMAC'd with. Shown
                      exactly once — it is never retrievable later. Store it
                      with the receiving service.
                required:
                  - id
                  - url
                  - events
                  - createdAt
                  - secret
        '409':
          description: That URL already receives this organization's events.
        '422':
          description: Not an https:// URL, or no valid event types.
      security:
        - apiKey: []
        - session: []
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: korve_api_key
    session:
      type: apiKey
      in: cookie
      name: korve.session_token

````