> ## Documentation Index > Fetch the complete documentation index at: https://docs.beinfi.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook endpoint > Registers a URL to receive signed events. The signing secret (`secret`) comes only in this response; store it in your secret manager. If you lose it, issue a new one with `POST /account/webhooks/{endpointID}/rotate-secret`. ## OpenAPI ````yaml /api-reference/openapi.en.json post /account/webhooks openapi: 3.1.0 info: title: Infi API version: 0.0.1 description: > The Infi REST API: catalog, customers, usage metering, subscriptions, invoices, payments and checkout. **Authentication.** Send your secret key as `Authorization: Bearer sk_test_…` (sandbox) or `sk_live_…` (production). The key prefix selects the environment. Checkout routes (`/pay/*`) and `/public/*` take no key: they run in the payer's browser. **Idempotency.** Every request that changes data requires an `Idempotency-Key` header. A retry with the same key returns the original response instead of running again. **Amounts.** Money and quantities travel as decimal strings (`"150.00"`, `"0.0001"`), never as floating-point numbers. **Errors.** The body carries `error_code` (stable, branch on it), `message` (for humans) and `tracer_id` (send it to support). Rate-limit and idempotency errors are nested under `error`, with `code` and `request_id`. servers: - url: https://api-sandbox.beinfi.com description: Sandbox - url: https://api.beinfi.com description: Production security: - bearerAuth: [] tags: - name: Catalog - name: Customers - name: Metering - name: Subscriptions - name: Invoices - name: Payments - name: Checkout - name: Coupons - name: Billing - name: Account - name: Webhooks - name: Test account - name: Rail - name: Storefronts paths: /account/webhooks: post: tags: - Webhooks summary: Create a webhook endpoint description: > Registers a URL to receive signed events. The signing secret (`secret`) comes only in this response; store it in your secret manager. If you lose it, issue a new one with `POST /account/webhooks/{endpointID}/rotate-secret`. operationId: createWebhook parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object required: - url - events properties: url: type: string format: uri description: HTTPS URL that receives deliveries. events: type: array items: type: string example: - payment.confirmed - invoice.finalized description: >- Events to receive, such as `payment.confirmed` and `invoice.finalized`. responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreatedWebhookEndpoint' description: Endpoint created, including the signing secret. '401': $ref: '#/components/responses/Unauthorized' '422': $ref: '#/components/responses/ValidationFailed' '503': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- `secret_store_unavailable`: the secret could not be stored right now. With a sandbox key (`sk_test_`) this is always the answer; poll for payment status instead of using a webhook. components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false schema: type: string description: >- A unique key per operation (a UUID works). Retrying with the same key returns the original response. schemas: CreatedWebhookEndpoint: allOf: - $ref: '#/components/schemas/WebhookEndpoint' - type: object properties: secret: type: string description: >- The newly created endpoint, with the signing secret (`secret`), shown only here. Error: type: object required: - message - error_code - tracer_id properties: message: type: string description: Human-readable sentence. error_code: $ref: '#/components/schemas/ErrorCode' description: Stable error code. Branch on it. tracer_id: type: string description: Request id. Include it when contacting support. description: >- The standard error body. It is flat (no `error` wrapper) and the trace id is `tracer_id`. WebhookEndpoint: type: object properties: id: type: string format: uuid url: type: string format: uri description: URL that receives deliveries. events: type: array items: type: string description: >- Subscribed events. Any emitted event can be subscribed to by name, including ones without a documented payload yet. isActive: type: boolean description: Whether the endpoint is receiving deliveries. createdAt: type: string format: date-time ValidationError: type: object required: - message - error_code - tracer_id - errors properties: message: type: string error_code: $ref: '#/components/schemas/ErrorCode' tracer_id: type: string errors: type: array items: type: object required: - field - value - constraint - description properties: field: type: string value: type: string constraint: type: string description: type: string description: >- Per-field detail (`field`, `description`). Always present on a `422`; may be empty. description: >- Body of a `422`. Same shape as `Error`, plus `errors[]` with per-field detail. That is where the sentence telling you what to fix lives (for example, "product has no published version"). ErrorCode: type: string examples: - internal_error - validation_failed - bad_request - unauthorized - forbidden - not_found - conflict - rate_limited description: >- Stable error code. The list is open: besides the generic codes, each area defines its own (`coupon_expired`, `insufficient_balance`, `version_not_draft`, `idempotency_key_reused`…). Handle a code you do not recognize by its HTTP status and show `message`; do not fail parsing the response. responses: Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Missing or invalid API key. ValidationFailed: content: application/json: schema: $ref: '#/components/schemas/ValidationError' description: One or more fields are invalid. Per-field detail is in `errors[]`. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your account's secret key: `Authorization: Bearer sk_test_…` or `sk_live_…`. Server-side only. ````