> ## Documentation Index > Fetch the complete documentation index at: https://docs.api.tamtam.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook endpoint > Register an HTTPS URL to have ICP signal events pushed to it, instead of polling for them. **The signing secret is returned once, in this response, and never again.** Store it now: it is what proves a push came from us. Every request carries `X-Tamtam-Signature: t=,v1=`, computed over `.`. Verify with a constant-time comparison, and reject a `t` far from now so a captured request cannot be replayed. The URL must resolve to a public address. Private, loopback, link-local and cloud-metadata destinations are refused with a 422, at registration and again at delivery time. Only events detected **after** this endpoint is registered are pushed to it — registering does not replay your history. Use [List ICP signals](/api-reference/icp-signal-watches/list-icp-signals) to backfill. Several endpoints per account are allowed. Registering the same URL twice returns 409. ## OpenAPI ````yaml /reference/openapi.yaml post /v2/webhook-endpoints openapi: 3.1.0 info: title: Tamtam Public API version: 2.0.0 servers: - url: https://api.tamtam.ai/api security: [] paths: /v2/webhook-endpoints: post: tags: - Webhooks summary: Create a webhook endpoint description: >- Register an HTTPS URL to have ICP signal events pushed to it, instead of polling for them. **The signing secret is returned once, in this response, and never again.** Store it now: it is what proves a push came from us. Every request carries `X-Tamtam-Signature: t=,v1=`, computed over `.`. Verify with a constant-time comparison, and reject a `t` far from now so a captured request cannot be replayed. The URL must resolve to a public address. Private, loopback, link-local and cloud-metadata destinations are refused with a 422, at registration and again at delivery time. Only events detected **after** this endpoint is registered are pushed to it — registering does not replay your history. Use [List ICP signals](/api-reference/icp-signal-watches/list-icp-signals) to backfill. Several endpoints per account are allowed. Registering the same URL twice returns 409. operationId: create-webhook-endpoint parameters: - description: >- Target account UUID. Required for staff callers; ignored for customer API keys. explode: false in: query name: account_id schema: description: >- Target account UUID. Required for staff callers; ignored for customer API keys. type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateWebhookEndpointInputBody' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CreatedWebhookEndpointDto' description: OK default: content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' description: Error security: - apikeyAuth: [] - bearerAuth: [] components: schemas: CreateWebhookEndpointInputBody: additionalProperties: false properties: description: description: Optional label to tell endpoints apart. examples: - Salesforce bridge type: string is_enabled: description: >- Defaults to true. Set false to register without receiving anything yet. examples: - true type: boolean url: description: >- HTTPS URL to POST events to. Must resolve to a public address: private, loopback, link-local and cloud-metadata destinations are refused. examples: - https://hooks.example.com/tamtam type: string required: - url type: object CreatedWebhookEndpointDto: additionalProperties: false properties: created_at: description: >- When the endpoint was registered. Only events detected after this are ever pushed to it. format: date-time type: string description: description: Free-text label, so several endpoints can be told apart. type: string id: description: Endpoint UUID. Use it to update, delete, or filter deliveries. type: string is_enabled: description: >- When false, nothing is pushed here. Events are unaffected and stay readable from the feed. type: boolean secret: description: >- The HMAC-SHA256 signing key for this endpoint. **Shown once, here, and never again** — store it now. Verify every push with it: the X-Tamtam-Signature header is t=,v1=, computed over the string + '.' + the raw request body. Compare with a constant-time function, and reject a timestamp far from now so a captured request cannot be replayed. examples: - whsec_9f2c type: string updated_at: description: When the endpoint was last changed. format: date-time type: string url: description: HTTPS destination events are POSTed to. examples: - https://hooks.example.com/tamtam type: string required: - secret - id - url - is_enabled - created_at - updated_at type: object ErrorModel: additionalProperties: false properties: detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object securitySchemes: apikeyAuth: description: Account API key passed in the Authorization header in: header name: Authorization type: apiKey bearerAuth: description: Bearer JWT obtained via the OAuth 2.1 authorization flow scheme: bearer type: http ````