Create Webhook

POST /webhooks

You can create a webhook by providing the following fields:

Property	Type	Description
`url`*	`string`	Where Loby sends webhook events: a public `https` URL with a host name, at most 2048 characters. Not `localhost`, an IP address, or a URL with a user name or password
`eventTypes`*	`array` of `string`	The event types to receive. At least one, each once
`description`	`string`	Your own note on what the webhook is for
`enabled`	`boolean`	Whether Loby sends webhook events to it. Defaults to `true`

The webhook gets the mode (live or test) of your API key. The response is the Webhook with its secret. Store the secret now: it is never shown again.


Copy
{
  "url": "https://example.com/loby/webhooks",
  "eventTypes": ["membership.created", "membership.updated", "membership.deleted"],
  "description": "CRM sync"
}

Response:


Copy
{
  "id": "9b2e4c6a-1d3f-4a5b-8c7d-0e1f2a3b4c5d",
  "createdAt": "2026-11-03T09:00:00.000Z",
  "updatedAt": "2026-11-03T09:00:00.000Z",
  "url": "https://example.com/loby/webhooks",
  "eventTypes": ["membership.created", "membership.updated", "membership.deleted"],
  "description": "CRM sync",
  "enabled": true,
  "secret": "whsec_EMI9soWck0iMI4fwI5p0TKobgZnsWf4yt1sGDJwQ6Xg="
}

Errors

Errors are returned as { "errors": [{ "message": "WEBHOOK_INVALID_URL" }] }.

Status	Message	When
`400`	`WEBHOOK_INVALID_URL`	`url` is not a public `https` URL with a host name
`400`	`WEBHOOK_INVALID_EVENT_TYPES`	`eventTypes` is empty, holds an unknown event type, or holds one twice
`400`	`FIELD_NOT_ALLOWED: <field>`	The body holds a field that isn't listed above
`400`	`INVALID_BODY`	The body isn't a JSON object, a required field is missing, or a field has the wrong JSON type (only `description` may be `null`)