# Flowg8 · Create webhook destination

Select a public destination and lifecycle events; receive its signing secret.

Requires an Idempotency-Key. The signing secret is returned only on creation or rotation, including a safe replay of that exact command. Keep it on your server; it is not an API access token. No real message is sent until a subscribed workflow event occurs.

## POST /v1/webhook-endpoints

Authentication: FLOWG8_ACCESS_TOKEN from Flowg8 sign-in
Required tenant header: X-Organization-Id.
Required user permissions: Administrator or Sandbox developer required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Input parameters
- name (string, required): min length 1 · max length 80
- url (string, required): uri · max length 2048
- events (array, required): min items 1 · max items 20
- active (boolean, optional): default true

## Request example (replace example IDs)

```sh
curl -X POST "https://api.flowg8.io/v1/webhook-endpoints" \
  -H "authorization: Bearer $FLOWG8_ACCESS_TOKEN" \
  -H "x-organization-id: 10000000-0000-4000-8000-000000000001" \
  -H "idempotency-key: example-create-webhook-001" \
  -H "content-type: application/json" \
  --data-raw '{
  "name": "ERP approvals",
  "url": "https://api.example.com/webhooks/flowg8",
  "events": [
    "gate.activated",
    "gate.approved",
    "gate.rejected",
    "run.approved",
    "run.rejected"
  ],
  "active": true
}'
```

## Response excerpt

```json
{
  "endpoint": {
    "id": "10000000-0000-4000-8000-000000000008",
    "name": "ERP approvals"
  },
  "signingSecret": "fg_whsec_<private signing secret>"
}
```

Source: /docs/create-webhook
Full schemas: /docs/openapi.json