> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Webhook Endpoint

> Create a new outbound webhook endpoint.

``target_url`` is validated against the SSRF guard on save.  Private,
loopback, link-local, multicast, and cloud-metadata IPs are rejected
(422).

``signing_secret`` is optional.  When absent, a cryptographically random
32-byte hex secret is generated server-side.  The secret is encrypted at
rest and is NEVER returned in API responses (write-only).

Returns 201 with the new ``webhook_endpoints`` resource (without the
signing secret).



## OpenAPI

````yaml /openapi/mio-openapi.json post /api/v1/teams/{team_id}/hubs/{hub_id}/webhook-endpoints
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /api/v1/teams/{team_id}/hubs/{hub_id}/webhook-endpoints:
    post:
      tags:
        - automations
        - webhook-endpoints
      summary: Create Webhook Endpoint
      description: |-
        Create a new outbound webhook endpoint.

        ``target_url`` is validated against the SSRF guard on save.  Private,
        loopback, link-local, multicast, and cloud-metadata IPs are rejected
        (422).

        ``signing_secret`` is optional.  When absent, a cryptographically random
        32-byte hex secret is generated server-side.  The secret is encrypted at
        rest and is NEVER returned in API responses (write-only).

        Returns 201 with the new ``webhook_endpoints`` resource (without the
        signing secret).
      operationId: >-
        automations.post_automations_post_teams_by_team_id_hubs_by_hub_id_webhook_endpoints
      parameters:
        - in: path
          name: team_id
          required: true
          schema:
            title: Team Id
            type: string
        - in: path
          name: hub_id
          required: true
          schema:
            title: Hub Id
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointCreateBody'
        required: true
      responses:
        '201':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointResponse'
          description: Successful Response
        '400':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Bad request
        '401':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Not authenticated
        '403':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Forbidden
        '404':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Not found
        '409':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Status conflict
        '415':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Unsupported media type (requires application/vnd.api+json)
        '422':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: Graph validation error
      security:
        - HTTPBearer: []
components:
  schemas:
    WebhookEndpointCreateBody:
      additionalProperties: false
      properties:
        data:
          $ref: '#/components/schemas/WebhookEndpointCreateResource'
      required:
        - data
      title: WebhookEndpointCreateBody
      type: object
    WebhookEndpointResponse:
      additionalProperties: false
      properties:
        data:
          $ref: '#/components/schemas/WebhookEndpointResource'
      required:
        - data
      title: WebhookEndpointResponse
      type: object
    JsonApiErrorResponse:
      description: Error JSON:API response.
      properties:
        errors:
          items:
            $ref: '#/components/schemas/JsonApiError'
          title: Errors
          type: array
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
      required:
        - errors
      title: JsonApiErrorResponse
      type: object
    WebhookEndpointCreateResource:
      additionalProperties: false
      properties:
        attributes:
          $ref: '#/components/schemas/WebhookEndpointCreateAttributes'
        type:
          const: webhook_endpoints
          title: Type
          type: string
      required:
        - type
        - attributes
      title: WebhookEndpointCreateResource
      type: object
    WebhookEndpointResource:
      additionalProperties: false
      properties:
        attributes:
          $ref: '#/components/schemas/WebhookEndpointAttributes'
        id:
          title: Id
          type: string
        type:
          const: webhook_endpoints
          default: webhook_endpoints
          title: Type
          type: string
      required:
        - id
        - attributes
      title: WebhookEndpointResource
      type: object
    JsonApiError:
      properties:
        code:
          anyOf:
            - type: string
            - type: 'null'
          title: Code
        detail:
          anyOf:
            - type: string
            - type: 'null'
          title: Detail
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
        source:
          anyOf:
            - additionalProperties:
                type: string
              type: object
            - type: 'null'
          title: Source
        status:
          title: Status
          type: string
        title:
          title: Title
          type: string
      required:
        - status
        - title
      title: JsonApiError
      type: object
    WebhookEndpointCreateAttributes:
      additionalProperties: false
      description: |-
        Attributes for creating a new webhook endpoint.

        ``signing_secret`` is optional.  When absent, a cryptographically random
        32-byte hex secret is generated server-side.  The secret is encrypted at
        rest; it is NEVER returned in any API response.
      properties:
        name:
          maxLength: 255
          minLength: 1
          title: Name
          type: string
        signing_secret:
          anyOf:
            - maxLength: 256
              minLength: 16
              type: string
            - type: 'null'
          title: Signing Secret
        target_url:
          maxLength: 2048
          minLength: 1
          title: Target Url
          type: string
      required:
        - name
        - target_url
      title: WebhookEndpointCreateAttributes
      type: object
    WebhookEndpointAttributes:
      additionalProperties: false
      description: |-
        Read-only attributes for a ``webhook_endpoints`` resource.

        ``signing_secret`` is intentionally ABSENT — it is write-only.
      properties:
        created_at:
          format: date-time
          title: Created At
          type: string
        created_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Created By
        enabled:
          title: Enabled
          type: boolean
        hub_id:
          title: Hub Id
          type: string
        name:
          title: Name
          type: string
        target_url:
          title: Target Url
          type: string
        team_id:
          title: Team Id
          type: string
        updated_at:
          format: date-time
          title: Updated At
          type: string
      required:
        - team_id
        - hub_id
        - name
        - target_url
        - enabled
        - created_at
        - updated_at
      title: WebhookEndpointAttributes
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http
    HTTPBearer:
      scheme: bearer
      type: http

````