# Create Webhook

Allows authenticated clients to configure webhook endpoints for receiving real-time
notifications about operation status changes. The webhook is only activated if the activation test is successful.

Webhook Events: After configuration, your endpoint will receive:
- Activation test: See WebhookActivationEvent schema below
- Status updates: See OperationStatusUpdateEvent schema below

Note: Only one active webhook is allowed per client. Creating a new webhook will deactivate any existing ones after successful activation.

Endpoint: POST /api/v1/cash/webhooks
Version: 1.0.0
Security: ClientAuth, HMACSignature, Timestamp

## Header parameters:

  - `X-Client-Id` (string, required)
    Client API key (32-character hex)
    Example: "4a8a08f09d37b73795649038408b5f33"

  - `X-Signature` (string, required)
    HMAC-SHA256 signature generated using api_secret
    Example: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

  - `X-Timestamp` (string, required)
    Unix timestamp (seconds since epoch)
    Example: "1705312200"

## Request fields (application/json):

  - `endpoint_url` (string, required)
    The webhook endpoint URL where notifications will be sent (must use http or https protocol)
    Example: "https://your-webhook-endpoint.com/webhooks"

## Response 201 fields (application/json):

  - `event` (string)
    Event type identifier
    Enum: "webhook.created"

  - `id` (integer)
    Unique identifier for the webhook configuration
    Example: 456

  - `endpoint_url` (string)
    The configured webhook endpoint URL
    Example: "https://your-webhook-endpoint.com/webhooks"

  - `secret_token` (string)
    64-character hexadecimal secret token for webhook signature verification
    Example: "644530cd9b0b431e61b8c6c656d17c77481047215a3ac66db71a7ad490397f7c"

  - `created_at` (string)
    ISO 8601 timestamp of webhook configuration creation
    Example: "2025-01-15T10:30:00Z"

## Response 400 fields (application/json):

  - `event` (string)
    Event type identifier
    Enum: "webhook.failed"

  - `errors` (any)
    Example: {"endpoint_url":["must be a valid URL"]}

## Response 401 fields (application/json):

  - `error` (string)
    Error message
    Example: "Unauthorized"