<!-- https://cutedyno.com/docs/api/create-webhook -->

# Create a webhook subscription

`POST https://api.cutedyno.com/v1/webhooks`

Registers an endpoint. Set scope to account to receive events from every profile through one endpoint. The signing secret is returned once.


Required permission: `webhooks:write`

Accepts `profileId` to target a specific profile. Omit it to use the key’s home profile.

Required permission: `webhooks:write`

Accepts an `Idempotency-Key` header.

MCP tool: `create_webhook`

## Body

- `url` (string, required) — HTTPS endpoint that receives POSTs.
- `events` (enum[], required) — Event types to subscribe to, or ["*"] for everything.
- `profileId` (string) — Profile to act on. Defaults to the profile the API key was created in.
- `scope` (object) — Defaults to profile.

## Request

```bash
curl -X POST "https://api.cutedyno.com/v1/webhooks" \
  -H "Authorization: Bearer $CUTEDYNO_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "profileId": "profile_a1b2c3d4",
  "url": "https://cdn.example.com/media/launch.jpg",
  "events": [
    "account.connected"
  ]
}'
```

```typescript
import { CuteDyno } from '@cutedyno/node';

const cutedyno = new CuteDyno();

const result = await cutedyno.webhooks.create({
  profileId: "profile_a1b2c3d4",
  url: "https://cdn.example.com/media/launch.jpg",
  events: [
    "account.connected"
  ]
});
console.log(result);
```

```python
import os
import requests

url = "https://api.cutedyno.com/v1/webhooks"
headers = {"Authorization": f"Bearer {os.environ['CUTEDYNO_API_KEY']}"}

payload = {
    "profileId": "profile_a1b2c3d4",
    "url": "https://cdn.example.com/media/launch.jpg",
    "events": [
        "account.connected"
    ]
}

response = requests.post(url, json=payload, headers=headers)
response.raise_for_status()
print(response.json())
```

## Response 201

- `subscription` (WebhookSubscription, required)
- `secret` (string, required) — Use this to verify the CuteDyno-Signature header.
- `retrySchedule` (number[], required) — Retry delays in seconds.

```json
{
  "subscription": {
    "id": "a1b2c3d4-0000-4000-8000-000000000000",
    "url": "https://cdn.example.com/media/launch.jpg",
    "events": [
      "string"
    ],
    "scope": "profile",
    "isActive": false,
    "createdAt": "string",
    "updatedAt": "string"
  },
  "secret": "whsec_2f8a...",
  "retrySchedule": [
    0
  ]
}
```

## Errors

- `invalid_request` (400) — The request body or query string failed validation. The message names the offending field.
- `invalid_api_key` (401) — The key does not exist, was revoked, or is malformed. Keys start with cdyn_live_.
- `insufficient_permission` (403) — The key is missing the scope this endpoint needs, for example posts:write on a readonly key.
- `rate_limit_exceeded` (429) — Too many requests for this key. Honour the Retry-After header before retrying.
- `internal_error` (500) — Something failed on our side. Retry with the same Idempotency-Key; report the requestId if it persists.