Add a webhook endpoint

POST/v1/webhook_endpoints

Adds an endpoint in the key's mode (test or live). The url must be HTTPS on port 443, without a user name or password, and its host a DNS name (not an IP address) whose every A and AAAA record is a public address. A host that does not resolve is refused, so a typo shows now rather than after three days of retries. auth.oauth2.token_url follows the same rules. The signing secret is in this response only: store it. The endpoint records who created it (created_by). Errors: webhook_url_invalid, webhook_url_port_not_allowed, webhook_url_not_public, webhook_url_unresolvable, webhook_event_type_unknown, webhook_auth_config_invalid, webhook_delivery_sources_invalid, webhook_endpoint_limit_reached.

Body

Required

urlstringrequired

HTTPS only.

Optional

event_typesarray of string

One of delivery.created delivery.rejected delivery.notified delivery.opened delivery.email_opened delivery.auth_failed delivery.confirmed delivery.downloaded delivery.delivered delivery.reminded delivery.bounced delivery.expired delivery.revoked delivery.consignment_failed delivery.evidence_sealed delivery.evidence_timestamp_deferred delivery.evidence_timestamp_recovered delivery.paper_pending_approval delivery.paper_dispatched delivery.paper_failed document.previewed batch.finalized batch.completed lookup.completed consent.granted consent.withdrawn invitation.sent link.opened otp.sent otp.verified otp.locked secret.attached secret.available secret.revealed secret.copied secret.expired secret.exhausted secret.revoked request.sent request.opened request.fulfilled request.expired request.closed request.reopened deletion.scheduled recipient_domain.verified recipient_domain.degraded recipient_domain.failed member.suspended member.restored member.removed batch.cancelled batch.policy_changed delivery.policy_changed email_sender.verified email_sender.degraded email_sender.failed email_sender.restored
descriptionstring · nullable

Your own note about the endpoint, up to 500 characters; null or left out for none.
at most 500 characters
authobject

How Parasend authenticates to your endpoint, in addition to the HMAC signature, which is always sent. Secrets are write-only: accepted on create and update, never returned. The endpoint shows mode, the settings that are not secret, and whether a secret is set.
3 fields of auth
- auth.modestringrequired
  
  none = HMAC only. static_bearer = an Authorization header carrying Bearer <token> with a customer-supplied token. oauth2_client_credentials = a token obtained from the customer's IdP by the client-credentials grant, cached until expiry, sent as the bearer.
  One of none static_bearer oauth2_client_credentials
  Default "none"
- auth.static_bearerobject · nullable
  
  With mode: static_bearer: the token Parasend sends as Authorization: Bearer <token>, at most 4,096 characters (write-only; responses show token_set). null for any other mode.
  1 field of static_bearer
  - auth.static_bearer.tokenstring
    
    Never returned. Rotate by writing a new value.
- auth.oauth2object · nullable
  
  With mode: oauth2_client_credentials: your token endpoint (token_url, HTTPS), client_id, client_secret (write-only; responses show client_secret_set), optional scope and audience, and auth_style. null for any other mode.
  6 fields of oauth2
  - auth.oauth2.token_urlstring · uri
    
    HTTPS only.
  - auth.oauth2.client_idstring
  - auth.oauth2.client_secretstring
    
    Never returned.
  - auth.oauth2.scopestring · nullable
  - auth.oauth2.audiencestring · nullable
  - auth.oauth2.auth_stylestring
    
    One of client_secret_basic client_secret_post
    Default "client_secret_basic"
delivery_sourcesobject · nullable

Omitted or null = every delivery (the default; what every endpoint had before).

Returns

201 application/json. Created (includes secret, shown only now). See the WebhookEndpoint object.

Errors have one shape; see Errors for every code.

Code language

Request

curl -X POST "https://api.parasend.com/v1/webhook_endpoints" \
  -H "Authorization: Bearer $PARASEND_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.fyrirtaeki.example/parasend",
    "description": "Case system",
    "event_types": [
      "delivery.notified",
      "delivery.confirmed",
      "delivery.evidence_sealed"
    ]
  }'

const res = await fetch('https://api.parasend.com/v1/webhook_endpoints', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.PARASEND_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: 'https://hooks.fyrirtaeki.example/parasend',
    description: 'Case system',
    event_types: ['delivery.notified', 'delivery.confirmed', 'delivery.evidence_sealed'],
  }),
});
const data = await res.json();

import os, requests, uuid

res = requests.post(
    "https://api.parasend.com/v1/webhook_endpoints",
    headers={
        "Authorization": f"Bearer {os.environ['PARASEND_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "url": "https://hooks.fyrirtaeki.example/parasend",
        "description": "Case system",
        "event_types": ["delivery.notified", "delivery.confirmed", "delivery.evidence_sealed"],
    },
)
data = res.json()

using var http = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://api.parasend.com/v1/webhook_endpoints");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("PARASEND_KEY"));
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
request.Content = new StringContent("""
{
  "url": "https://hooks.fyrirtaeki.example/parasend",
  "description": "Case system",
  "event_types": [
    "delivery.notified",
    "delivery.confirmed",
    "delivery.evidence_sealed"
  ]
}
""", Encoding.UTF8, "application/json");
var response = await http.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

var json = """
    {
      "url": "https://hooks.fyrirtaeki.example/parasend",
      "description": "Case system",
      "event_types": [
        "delivery.notified",
        "delivery.confirmed",
        "delivery.evidence_sealed"
      ]
    }
    """;
var request = HttpRequest.newBuilder(URI.create("https://api.parasend.com/v1/webhook_endpoints"))
    .header("Authorization", "Bearer " + System.getenv("PARASEND_KEY"))
    .header("Idempotency-Key", UUID.randomUUID().toString())
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString(json))
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

$client = new GuzzleHttp\Client();
$response = $client->request('POST', 'https://api.parasend.com/v1/webhook_endpoints', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('PARASEND_KEY'),
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
    'json' => [
        'url' => 'https://hooks.fyrirtaeki.example/parasend',
        'description' => 'Case system',
        'event_types' => ['delivery.notified', 'delivery.confirmed', 'delivery.evidence_sealed'],
    ],
]);
$data = json_decode($response->getBody(), true);

Response · 201

{
  "id": "whk_01M6R27T4KCSN7M0CHFGVH7JRA",
  "object": "webhook_endpoint",
  "url": "https://hooks.fyrirtaeki.example/parasend",
  "event_types": [
    "delivery.notified",
    "delivery.confirmed",
    "delivery.evidence_sealed"
  ],
  "description": "Case system",
  "secret": "whsec_ORQVKTHUQmNP3FrN6SNpPik8rEBsOLrSX63VnJQeaPM",
  "auth": {
    "mode": "none",
    "static_bearer": null,
    "oauth2": null
  },
  "delivery_sources": null,
  "status": "enabled",
  "livemode": false,
  "exhausted_events": 0,
  "last_exhausted_at": null,
  "retrying_events": 0,
  "last_attempt": null,
  "created_by": {
    "user_id": "usr_01M6R27SYD4B50414S0BZ4KBKR",
    "name": "Jóna Jónsdóttir",
    "via": "api_key"
  },
  "previous_secret_expires_at": null,
  "created": "2026-11-06T09:15:05.746Z"
}