> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trycontour.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook endpoint

> Register a URL to receive events.

The response includes the signing `secret` **once**. Store it in your
webhook handler's configuration; it is never returned again. If you lose
it, rotate the secret to get a new one.

The URL must be `https` and publicly reachable. Omit `agent_ids` to receive
events for every call in your organization, including calls started from
the Contour dashboard; use `call.source` on the payload to tell them apart.



## OpenAPI

````yaml api-reference/openapi.json POST /v1/webhook-endpoints
openapi: 3.1.0
info:
  description: >-
    Programmatic access to Contour from your own backend: place outbound calls,
    read their results, and manage the webhook endpoints that receive signed
    `call.started`, `call.ended` and `call.analyzed` events.
  title: Contour API
  version: '1.0'
servers:
  - url: https://api.contourvoice.com
security:
  - HTTPBearer: []
tags:
  - description: Place outbound calls and read their state and recordings.
    name: Calls
  - description: >-
      Register URLs to receive signed events, send test events, and inspect or
      retry deliveries.
    name: Webhook Endpoints
paths:
  /v1/webhook-endpoints:
    post:
      tags:
        - Webhook Endpoints
      summary: Create a webhook endpoint
      description: >-
        Register a URL to receive events.


        The response includes the signing `secret` **once**. Store it in your

        webhook handler's configuration; it is never returned again. If you lose

        it, rotate the secret to get a new one.


        The URL must be `https` and publicly reachable. Omit `agent_ids` to
        receive

        events for every call in your organization, including calls started from

        the Contour dashboard; use `call.source` on the payload to tell them
        apart.
      operationId: create_webhook_endpoint
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointCreate'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointSecretResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              example:
                detail: Invalid or expired API key
          description: Missing or invalid API key.
        '422':
          content:
            application/json:
              example:
                detail: url must use https.
          description: >-
            The URL is not https or not publicly reachable, an agent id is not
            yours, or an event name is unknown.
      security:
        - HTTPBearer: []
components:
  schemas:
    WebhookEndpointCreate:
      examples:
        - agent_ids:
            - 3f1c1b2e-6d1a-4c0e-9b2f-1a2b3c4d5e6f
          description: Production
          events:
            - call.started
            - call.ended
            - call.analyzed
          url: https://example.com/webhooks/contour
      properties:
        agent_ids:
          anyOf:
            - items:
                format: uuid
                type: string
              type: array
            - type: 'null'
          description: >-
            Only deliver events for calls made by these agents. Omit (or send
            null) to receive events for every call in your organization,
            including calls started from the Contour dashboard.
          title: Agent Ids
        description:
          anyOf:
            - maxLength: 500
              type: string
            - type: 'null'
          description: A label for your own reference.
          title: Description
        events:
          description: >-
            Which events to receive. Any subset of `call.started`, `call.ended`,
            `call.analyzed`.
          items:
            type: string
          title: Events
          type: array
        url:
          description: >-
            HTTPS URL we POST events to. Must be publicly reachable; private and
            loopback addresses are rejected.
          title: Url
          type: string
      required:
        - url
        - events
      title: WebhookEndpointCreate
      type: object
    WebhookEndpointSecretResponse:
      description: Returned by create and rotate-secret only. ``secret`` is shown once.
      examples:
        - agent_ids:
            - 3f1c1b2e-6d1a-4c0e-9b2f-1a2b3c4d5e6f
          created_at: '2026-09-10T14:00:00Z'
          description: Production
          enabled: true
          events:
            - call.started
            - call.ended
            - call.analyzed
          id: b7e1c2d3-4f5a-4b6c-8d7e-9f0a1b2c3d4e
          secret: whsec_x9K2mQ7vR4tL8nP1sW5yB3dF6hJ0k9Qz
          secret_hint: k9Qz
          updated_at: '2026-09-10T14:00:00Z'
          url: https://example.com/webhooks/contour
      properties:
        agent_ids:
          anyOf:
            - items:
                format: uuid
                type: string
              type: array
            - type: 'null'
          description: Agent filter, or null for all calls in the organization.
          title: Agent Ids
        created_at:
          format: date-time
          title: Created At
          type: string
        description:
          anyOf:
            - type: string
            - type: 'null'
          description: Your label.
          title: Description
        enabled:
          description: False while deliveries are paused.
          title: Enabled
          type: boolean
        events:
          description: Subscribed events.
          items:
            type: string
          title: Events
          type: array
        id:
          description: Endpoint id; use it in every other endpoint call.
          format: uuid
          title: Id
          type: string
        secret:
          description: >-
            The signing secret (`whsec_...`). Shown in this response only; store
            it in your webhook handler's configuration.
          title: Secret
          type: string
        secret_hint:
          description: >-
            The last four characters of the signing secret, so you can tell
            which secret an endpoint is using without exposing it.
          title: Secret Hint
          type: string
        updated_at:
          format: date-time
          title: Updated At
          type: string
        url:
          description: Where events are delivered.
          title: Url
          type: string
      required:
        - id
        - url
        - events
        - enabled
        - secret_hint
        - created_at
        - updated_at
        - secret
      title: WebhookEndpointSecretResponse
      type: object
  securitySchemes:
    HTTPBearer:
      description: >-
        Your organization's API key (`sk_cont_...`), sent as `Authorization:
        Bearer sk_cont_...`. Keep it server-side.
      scheme: bearer
      type: http

````