POST
/
v1
/
webhooks
curl -X POST https://v2.app-dev.zquence.com/v1/webhooks \
  -H "content-type: application/json" \
  -H "x-api-key: $ZQUENCE_PUBLIC_KEY" \
  -H "x-api-secret: $ZQUENCE_SECRET_KEY" \
  -d '{
    "url": "https://example.com/webhooks/zquence",
    "events": ["sanctions.*"],
    "secret": "replace-with-a-long-random-secret"
  }'
Requires API-key scope webhooks.write and tenant permission webhook.manage.
​
url
string
required
Public HTTPS receiver URL. Private, loopback, link-local, reserved, credential-bearing, and unsupported-port URLs are rejected.
​
events
string[]
required
Exact event names, namespace wildcards such as sanctions.*, or *.
​
secret
string
Signing secret. Zquence generates one when omitted.
​
environmentId
string
Must match an environment available to the tenant. An environment-bound key already supplies its environment.
​
status
string
active or disabled.
curl -X POST https://v2.app-dev.zquence.com/v1/webhooks \
  -H "content-type: application/json" \
  -H "x-api-key: $ZQUENCE_PUBLIC_KEY" \
  -H "x-api-secret: $ZQUENCE_SECRET_KEY" \
  -d '{
    "url": "https://example.com/webhooks/zquence",
    "events": ["sanctions.*"],
    "secret": "replace-with-a-long-random-secret"
  }'
Store the secret in a server-side secrets manager and verify each delivery against the raw body. See Signatures.