Skip to main content
POST
Register a webhook endpoint

Authorizations

x-api-key
string
header
required

Raw API key shown once when created in the Allocait app (Settings > API keys). Send it verbatim in this header; the server stores and compares only its SHA-256 hash. Allocait generates every key: alc_ followed by 64 lowercase hex characters. Keys issued before 2026-10-10 are 64 hex characters with no prefix and keep working. A key may carry an expiry (90 days or 1 year, or never). A malformed, unknown, revoked or expired key gets 401 with no further detail, and a malformed one is refused before any lookup. Keys cannot be created through this API.

Body

application/json
url
string
required

Must start with https://.

Maximum string length: 2048
events
enum<string>[]
required
Minimum array length: 1
Available options:
compliance.violation,
compliance.resolved,
monitor.confirmed,
monitor.retraced,
monitor.cleared

Response

The endpoint was registered

success
boolean
webhook
object

Never carries secret; that is returned once, only in the create response below (ADR-005).