> ## Documentation Index
> Fetch the complete documentation index at: https://docs.waycore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Webhook

> Register a new webhook endpoint to receive event notifications. The response includes the HMAC-SHA256 signing `secret` in full; it is masked on subsequent reads. Access requires a machine API key with `webhooks:write` scope for the bound organization. Current producers emit `transactions.sync_available` and `connection.status_changed`, and `test` can be triggered explicitly via the API. The remaining spec-defined event types are reserved for upcoming producers.



## OpenAPI

````yaml /openapi.json post /v1/webhooks
openapi: 3.1.0
info:
  title: Waycore Bank Connections API
  description: >-
    Developer-first API for direct bank connections, accounts, and transactions.


    Design goals:

    - Flat records with minimal nesting.

    - Clear, bank-centric naming.

    - One canonical endpoint per resource.

    - Sparse fieldsets via `fields=`.

    - Historical browsing via `GET /transactions`.

    - Incremental ETL via `GET /transactions/sync`.

    - Discover supported institutions via `GET /institutions`.

    - Model downstream client businesses via `/entities` and explicit `entityId`
    ownership.


    Authentication:

    - Opaque API keys passed as `Authorization: Bearer <key>`.

    - Key format: `way_<environment>_<key_id>_<secret>`.

    - Keys are organization-bound, environment-bound (`live` or `test`),
    scope-carrying, and expiring.

    - Managed via the Waycore Console.
  version: 0.5.0
servers:
  - url: https://api.waycore.com
security: []
paths:
  /v1/webhooks:
    post:
      tags:
        - webhooks
      summary: Create Webhook
      description: >-
        Register a new webhook endpoint to receive event notifications. The
        response includes the HMAC-SHA256 signing `secret` in full; it is masked
        on subsequent reads. Access requires a machine API key with
        `webhooks:write` scope for the bound organization. Current producers
        emit `transactions.sync_available` and `connection.status_changed`, and
        `test` can be triggered explicitly via the API. The remaining
        spec-defined event types are reserved for upcoming producers.
      operationId: create_webhook_v1_webhooks_post
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateWebhookResponse'
        '400':
          description: >-
            Bad Request. `type` may be `invalid_request` for malformed request
            bodies, query parameters, path parameters, or validation failures.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicErrorResponse'
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicErrorResponse'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicErrorResponse'
          description: Forbidden
        '429':
          description: >-
            Too Many Requests. Retry after the number of seconds in
            `Retry-After` when present, then retry the same request.
          headers:
            Retry-After:
              description: >-
                Number of seconds to wait before retrying, when rate limiting
                provides a specific backoff.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicErrorResponse'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicErrorResponse'
          description: Internal Server Error
      security:
        - apiKeyBearer:
            - webhooks:write
components:
  schemas:
    CreateWebhookRequest:
      properties:
        url:
          type: string
          maxLength: 2048
          pattern: ^https://.+
          format: uri
          title: Url
          description: HTTPS URL where events will be delivered via POST.
        events:
          items:
            $ref: '#/components/schemas/WebhookEventType'
          type: array
          minItems: 1
          uniqueItems: true
          title: Events
          description: >-
            Event types to subscribe to. Current producers emit
            `transactions.sync_available` and `connection.status_changed`, and
            `test` can be triggered explicitly via the API. The remaining
            spec-defined event types are reserved for upcoming producers.
        metadata:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Metadata
          description: Opaque client-defined metadata.
      additionalProperties: false
      type: object
      required:
        - url
        - events
      title: CreateWebhookRequest
    CreateWebhookResponse:
      properties:
        webhook:
          $ref: '#/components/schemas/Webhook'
          description: >-
            The created webhook registration. The `secret` is shown in full only
            in this response.
        meta:
          $ref: '#/components/schemas/app__webhooks__public__models__Meta'
      type: object
      required:
        - webhook
        - meta
      title: CreateWebhookResponse
    PublicErrorResponse:
      properties:
        type:
          title: Type
          type: string
        message:
          type: string
          title: Message
        requestId:
          anyOf:
            - type: string
            - type: 'null'
          title: Requestid
        details:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Details
      type: object
      required:
        - type
        - message
      title: PublicErrorResponse
    WebhookEventType:
      type: string
      enum:
        - connection.status_changed
        - account.created
        - account.updated
        - transactions.sync_available
        - transfer.status_changed
        - test
      title: WebhookEventType
    Webhook:
      properties:
        id:
          type: string
          title: Id
          description: Stable, immutable identifier for the webhook registration.
        url:
          type: string
          maxLength: 2048
          pattern: ^https://.+
          format: uri
          title: Url
          description: HTTPS URL where events are delivered via POST.
        events:
          items:
            $ref: '#/components/schemas/WebhookEventType'
          type: array
          uniqueItems: true
          title: Events
          description: >-
            Event types to subscribe to. Current producers emit
            `transactions.sync_available` and `connection.status_changed`, and
            `test` can be triggered explicitly via the API. The remaining
            spec-defined event types are reserved for upcoming producers.
        secret:
          type: string
          title: Secret
          description: >-
            HMAC-SHA256 signing secret for webhook delivery verification. The
            server includes a `Waycore-Signature` header on each delivery using
            the format `t=<unix>,v1=<hex>`, where `v1` is the HMAC-SHA256 of
            `<timestamp>.<raw_body>`. Only returned in full on creation;
            subsequent reads return a masked value.
        active:
          type: boolean
          title: Active
          description: >-
            Whether this webhook registration is enabled. Deliveries are sent
            only to active webhook registrations.
        createdAt:
          type: string
          format: date-time
          title: Createdat
          description: When the webhook was registered.
        updatedAt:
          type: string
          format: date-time
          title: Updatedat
          description: When the webhook registration last changed.
        metadata:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Metadata
          description: Opaque client-defined metadata.
      type: object
      required:
        - id
        - url
        - events
        - secret
        - active
        - createdAt
        - updatedAt
      title: Webhook
    app__webhooks__public__models__Meta:
      properties:
        requestId:
          type: string
          title: Requestid
          description: Request identifier for support and debugging.
      type: object
      required:
        - requestId
      title: Meta
  securitySchemes:
    apiKeyBearer:
      type: http
      scheme: bearer
      bearerFormat: way_<environment>_<key_id>_<secret>
      description: >-
        Opaque API key passed as `Authorization: Bearer <key>`. Keys are
        organization-bound, environment-bound (`live` or `test`),
        scope-carrying, and expiring. Create and manage keys via the console.

````