First Leeward

Webhooks

Create webhook endpoint

POSThttps://api.firstleeward.com/v0/webhooks

Registers a webhook endpoint for the project. The response includes a one-time signingSecret that the partner must store to verify incoming webhook signatures.

mode defaults to NOTIFICATION (async event delivery), of which a maximum of 5 ACTIVE per project is enforced - disable an existing one to make room. Pass REQUEST to register the project's single synchronous authorization endpoint (exactly one per project, rotate-only, available only on projects with EXTERNAL authorization mode).

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Idempotency-Keystring

Unique key for safely retrying this request. Up to 255 characters; we recommend a UUIDv4. The first request executes and its response is cached; subsequent requests with the same key replay the cached response (24h retention).

Body

application/json

namestringrequired

Human-readable label for this webhook (e.g. prod-events, staging-mirror). Surfaced in logs and the partner dashboard.

urlstring<uri>required

HTTPS endpoint that will receive webhook POST requests. Must be reachable from the public internet (HTTPS only, no private IPs).

modestringdefault: "NOTIFICATION"

Interaction pattern of the endpoint. Defaults to NOTIFICATION.

Available options:NOTIFICATIONREQUEST

Response

200Created webhook, including its one-time signing secret.
idstring<uuid>required

Unique webhook identifier

namestringrequired

Human-readable label

urlstringrequired

HTTPS endpoint that receives signed POSTs

statusstringrequired

Lifecycle status. Disabled webhooks receive no deliveries.

Available options:ACTIVEDISABLED
modestringrequired

Interaction pattern of the endpoint.

Available options:NOTIFICATIONREQUEST
lastUsedAtstring<date-time> | nullrequired

Timestamp of the most recent successful delivery

createdAtstring<date-time>required

ISO 8601 creation timestamp

updatedAtstring<date-time>required

ISO 8601 last update timestamp

signingSecretstringrequired

HMAC signing secret. Returned exactly once. Store it securely - it cannot be retrieved again. The previous secret (if any) is invalidated immediately.

400Webhook URL is invalid - must be HTTPS and resolve to a public address
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
409Response for status 409
Option 1 · WebhookLimitExceededError
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
Option 2 · RequestWebhookAlreadyExistsError
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired