Add a webhook endpoint

POSThttps://api.norreach.app/v1/webhook-endpoints

Sends the chosen events to your URL, signed. The answer includes the signing secret — the only time it is shown. You can subscribe only to events this key's scopes may read (e.g. lead.submitted needs pages:read). Workspace admins are told when an endpoint is added.

webhooks:writeRole must allow: api.keysOperation id: create_webhook_endpoint

POST/webhook-endpoints

curl -X POST "https://api.norreach.app/v1/webhook-endpoints" \
  -H "Authorization: Bearer $NORREACH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://hooks.example.com/norreach",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ]
}'

Add a webhook endpoint

{
  "id": "0f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
  "object": "webhook_endpoint",
  "url": "https://hooks.example.com/norreach",
  "description": "CRM sync",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ],
  "status": "active",
  "include_content": false,
  "disabled_reason": null,
  "created_by": "0b6f8a52-8d9e-4c1a-b7f3-5e2d9c4a1b00",
  "created_via_key": true,
  "previous_secret_valid_until": null,
  "created_at": "2026-11-04T09:12:33.120Z",
  "updated_at": "2026-11-04T09:12:33.120Z",
  "secret": "whsec_9x2…"
}

Authorizations

Authorizationstringheaderrequired

Bearer authentication: send Authorization: Bearer <key>, with an API key or an OAuth access token. The key needs the scope webhooks:write. API keys and scopes

Headers

Idempotency-Keystringheader

Any unique string (≤ 255). The same key with the same request returns the first answer for 24 hours.

Body

application/json

urlstringrequired

A public https:// address on port 443.

descriptionstring | null

event_typesenum[]required

include_contentboolean

Response

201application/json— Add a webhook endpoint

idstring (uuid)required

An id (UUID).

object"webhook_endpoint"required

urlstringrequired

descriptionstring | nullrequired

event_typesstring[]required

statusenumrequired

paused = the person who made it left; an admin takes it over in Settings.

One of:activedisabledpaused

include_contentbooleanrequired

Message events carry the subject and text.

disabled_reasonstring | nullrequired

by_user, gone (the endpoint answered 410), failing, creator_inactive.

created_bystring (uuid) | nullrequired

created_via_keybooleanrequired

previous_secret_valid_untilstring | nullrequired

After a rotation the old secret also signs until then.

created_atstringrequired

RFC 3339 UTC timestamp with milliseconds.

updated_atstringrequired

RFC 3339 UTC timestamp with milliseconds.

secretstringrequired

The signing secret — shown only now. Store it; NorReach keeps only an encrypted copy.

Errors

Errors are application/problem+json with a stable code.

Status	Code	Meaning
400	`bad_request`	The request couldn't be read.
400	`unknown_field`	The request has a field this operation doesn't know.
401	`unauthorized`	A valid API key is required.
403	`insufficient_scope`	This API key doesn't have the scope this operation needs.
403	`feature_not_enabled`	The API isn't switched on for this workspace.
403	`role_forbidden`	The key's creator's role can't do this.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
409	`conflict`	That conflicts with the current state.
413	`too_large`	The request body is too large.
422	`validation_failed`	The request has invalid fields.
422	`idempotency_mismatch`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Slow down and try again.
500	`server_error`	Something went wrong on our side.
503	`unavailable`	The API isn't available right now. Try again shortly.

POST/webhook-endpoints

curl -X POST "https://api.norreach.app/v1/webhook-endpoints" \
  -H "Authorization: Bearer $NORREACH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://hooks.example.com/norreach",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ]
}'

Add a webhook endpoint

{
  "id": "0f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
  "object": "webhook_endpoint",
  "url": "https://hooks.example.com/norreach",
  "description": "CRM sync",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ],
  "status": "active",
  "include_content": false,
  "disabled_reason": null,
  "created_by": "0b6f8a52-8d9e-4c1a-b7f3-5e2d9c4a1b00",
  "created_via_key": true,
  "previous_secret_valid_until": null,
  "created_at": "2026-11-04T09:12:33.120Z",
  "updated_at": "2026-11-04T09:12:33.120Z",
  "secret": "whsec_9x2…"
}