> ## Documentation Index > Fetch the complete documentation index at: https://docs.polygon.technology/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook > Registers an HTTPS endpoint with event subscriptions. The HMAC signing key is returned in cleartext once and never again. ## OpenAPI ````yaml /api-reference/openapi.yaml post /webhooks openapi: 3.0.3 info: title: Polygon OMS Public API version: v26.05.28-0001 description: >- Unified API for moving money between crypto and fiat. Three ways to move money: Transactions (instant, wallet or card funded, including Cash-In for in-person cash deposits), Deposit Addresses (reusable crypto deposit configurations), and Virtual Accounts (dedicated bank accounts that auto-convert fiat to crypto). Standard transactions follow a two-step flow: create a Quote (pricing), then create a Transaction (execution). Cash-in codes generate a one-time deposit code for in-person cash deposits at retail locations. contact: name: Polygon OMS url: https://oms.polygon.technology servers: - url: https://sandbox-api.polygon.technology/v0.11 description: Sandbox - url: https://api.polygon.technology/v0.11 description: Production security: - BearerAuth: [] tags: - name: Auth description: Authentication via FrontEgg - name: Customers description: Customer management and KYC - name: Customer - name: Wallet - name: Quote - name: Transaction - name: CashIns - name: CashLocation - name: Sandbox - name: VirtualAccount - name: Counterparty - name: ExternalAccount - name: DepositAddress paths: /webhooks: post: tags: - Webhooks summary: Create a webhook description: >- Registers an HTTPS endpoint with event subscriptions. The HMAC signing key is returned in cleartext once and never again. operationId: createWebhook parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WebhookRequest' responses: '201': description: Webhook created content: application/json: schema: $ref: '#/components/schemas/CreateWebhookResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: true schema: type: string description: Unique key to prevent duplicate requests. Required on all POST requests. example: ord_123_attempt_1 schemas: WebhookRequest: type: object required: - url - subscriptions properties: url: type: string example: https://partner.example/webhooks subscriptions: type: array items: type: string example: - transaction.settled - '*' timeoutMs: type: integer description: >- Per-webhook HTTP timeout in milliseconds. Default 5000, hard cap 10000. notifyThresholdSecs: type: integer description: Down-notification threshold in seconds (600 – 86400; default 3600). CreateWebhookResponse: type: object required: - webhook - signingKey properties: webhook: $ref: '#/components/schemas/Webhook' signingKey: type: string description: >- Cleartext HMAC signing key. Shown once — store it immediately; it is never returned again. ErrorResponse: type: object required: - error - code - msg - status description: >- Canonical OMSX error envelope, matching the webrpc shape every OMSX service emits. Names and numeric codes are stable identifiers defined in `schema/omsx/errors.ridl`. properties: error: type: string description: Stable error name from schema/omsx/errors.ridl example: Unauthorized code: type: integer description: Stable numeric code from schema/omsx/errors.ridl example: 1000 msg: type: string description: Human-readable message (kept stable across releases) example: unauthorized access cause: type: string description: >- Optional internal cause for operator triage; filtered before reaching end customers example: signature status: type: integer description: HTTP status mirrored in the body for client convenience example: 401 Webhook: type: object description: >- A partner-configured webhook endpoint. The signing key is never serialized back; it is returned in cleartext only from create/rotate-key. properties: id: type: string x-go-type-skip-optional-pointer: true example: whk_01H9Xa8F5dN6mP3q object: type: string x-go-type-skip-optional-pointer: true example: webhook url: type: string x-go-type-skip-optional-pointer: true example: https://partner.example/webhooks status: $ref: '#/components/schemas/WebhookStatus' statusReason: type: string x-go-type-skip-optional-pointer: true nullable: true description: Set on transition to suspended; describes the down/suspend cause. subscriptions: type: array x-go-type-skip-optional-pointer: true items: type: string example: - transaction.settled - '*' timeoutMs: type: integer x-go-type-skip-optional-pointer: true description: Per-webhook HTTP timeout. Default 5000, hard cap 10000. example: 5000 notifyThresholdSecs: type: integer x-go-type-skip-optional-pointer: true nullable: true description: Down-notification threshold (10 min – 1 day; default 1 h). successCount: type: integer x-go-type-skip-optional-pointer: true format: int64 failureCount: type: integer x-go-type-skip-optional-pointer: true format: int64 mode: $ref: '#/components/schemas/WebhookMode' createdAt: type: string format: date-time updatedAt: type: string format: date-time WebhookStatus: type: string enum: - enabled - disabled - suspended description: >- Webhook lifecycle state. `suspended` is set only by the service when the endpoint is unhealthy. WebhookMode: type: string enum: - live - sandbox securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: Token from POST /auth/token ````