> ## Documentation Index > Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook endpoint subscription > Registers a new outbound webhook endpoint for the authenticated entity. Arcus will POST signed JSON payloads to the `url` whenever a subscribed event fires. The response includes a one-time plaintext `secret` (format: `whsec_`). Store it immediately -- subsequent GET requests omit the secret. The secret is also stored in AWS Secrets Manager and retrievable later via GET `.../secret` (admin-only). Signing: every delivery includes an `Arcus-Signature` header with `t=,v1=`. Verify with the stored secret. **Field names:** use `enabled_events` (Stripe convention). The deprecated alias `events` is accepted for back-compat and produces a deprecation warning in CloudWatch. The alias will be removed in v2. Requires `webhooks:manage` scope. ## OpenAPI ````yaml /openapi.yaml post /webhook_endpoints openapi: 3.1.0 info: title: Arcus ERP Public API version: 1.0.0 description: > Arcus ERP public REST API. Designed for external integrations and data migration. **Authentication.** Bearer token (API key) via the `Authorization` header. Format: `Authorization: Bearer ark_live_ent__` (or `ark_test_*` for sandbox). API keys are issued per-entity in **Settings > Developers > API Keys**. **Entity scoping.** The entity is encoded in the API key prefix; routes are flat (e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform endpoints (migration, reconciliation, events, webhook endpoints, API keys) use the `/v1/entities/{entity_id}/...` form -- those are noted in their tags. **Key capabilities.** - Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource). - Cursor-based pagination (`starting_after` / `ending_before` / `limit`). - Idempotency via the `Idempotency-Key` header. - Webhook events for asynchronous notification. - Conditional requests / ETag for cache validation. servers: - url: https://api.arcuserp.com/v1 description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys) - url: https://dev-api.arcuserp.com/v1 description: >- Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev RDS) security: [] paths: /webhook_endpoints: post: tags: - Webhooks summary: Create a webhook endpoint subscription description: > Registers a new outbound webhook endpoint for the authenticated entity. Arcus will POST signed JSON payloads to the `url` whenever a subscribed event fires. The response includes a one-time plaintext `secret` (format: `whsec_`). Store it immediately -- subsequent GET requests omit the secret. The secret is also stored in AWS Secrets Manager and retrievable later via GET `.../secret` (admin-only). Signing: every delivery includes an `Arcus-Signature` header with `t=,v1=`. Verify with the stored secret. **Field names:** use `enabled_events` (Stripe convention). The deprecated alias `events` is accepted for back-compat and produces a deprecation warning in CloudWatch. The alias will be removed in v2. Requires `webhooks:manage` scope. operationId: createWebhookEndpointV1 requestBody: required: true content: application/json: schema: type: object required: - url - enabled_events properties: url: type: string format: uri description: >- HTTPS endpoint Arcus will POST events to. Must not be a private/loopback address. enabled_events: type: array items: type: string description: > Event types this endpoint subscribes to. Use `*` for all 118 events, `.*` for a whole family (e.g. `order.*`), or individual event names (e.g. `order.confirmed`). Must be non-empty. example: - order.confirmed - payment.succeeded - fulfillment.shipped events: type: array items: type: string description: > **Deprecated.** Use `enabled_events` instead. Accepted for back-compat; ignored when `enabled_events` is also present. Removed in v2. description: type: string nullable: true description: Human-readable label for this endpoint (optional). mode: type: string enum: - live - test default: live description: >- `live` endpoints receive production events; `test` endpoints receive test-mode events only. api_version: type: string nullable: true description: >- Pin this endpoint to a specific API version for payload serialization (optional). metadata: type: object description: >- Arbitrary key-value pairs (up to 50 keys). Stored and returned as-is. send_test_event_on_create: type: boolean default: false description: > When true, queues an immediate `webhook.test` delivery to this endpoint on creation. The response includes `test_event.event_id` and `test_event.queued_delivery_id`. Delivery fires once INFRA-011 (webhook deliverer Lambda) is provisioned. responses: '201': description: >- Webhook endpoint created. The `secret` field is present ONCE in this response only. content: application/json: schema: allOf: - $ref: '#/components/schemas/WebhookEndpoint' - type: object properties: secret: type: string description: >- One-time plaintext signing secret (format `whsec_`). Store immediately. example: >- whsec_0dd4b245a4d0e52378158d69e34c73e1ef64896ddbf14cdd76e1234abcd5678 test_event: type: object nullable: true description: Present when `send_test_event_on_create=true`. properties: event_id: type: string format: uuid queued_delivery_id: type: string format: uuid nullable: true status: type: string enum: - queued_pending_infra_011 infra_011_notice: type: string '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '409': description: >- duplicate_url: A live/test-mode endpoint for this URL already exists. content: application/json: schema: type: object properties: error: type: string example: duplicate_url existing_id: type: string format: uuid '422': $ref: '#/components/responses/Error' security: - ApiKeyAuth: [] components: schemas: WebhookEndpoint: type: object description: > An outbound webhook endpoint subscription. Arcus delivers signed JSON payloads to the `url` whenever a subscribed event fires. **Field names:** the subscription list is `enabled_events` (Stripe convention). The deprecated alias `events` is accepted in request bodies for back-compat and will be removed in v2. properties: id: type: string format: uuid object: type: string enum: - webhook_endpoint entity_id: type: string format: uuid url: type: string format: uri description: HTTPS endpoint receiving events. description: type: string nullable: true enabled_events: type: array items: type: string description: > Event types this endpoint subscribes to. Wildcards supported: `*` (all 118 events) or `.*` (e.g. `order.*`). example: - order.confirmed - payment.succeeded - fulfillment.shipped secret_last4: type: string nullable: true description: Last 4 hex chars of the signing secret (for identification only). status: type: string enum: - active - paused - disabled description: >- `active` receives events; `paused` skips delivery (retains subscription); `disabled` is permanently off. mode: type: string enum: - live - test description: >- `live` endpoints receive production events; `test` endpoints receive test-mode events only. api_version: type: string nullable: true success_count: type: integer description: Total successful deliveries (HTTP 2xx). failure_count: type: integer description: Total failed deliveries (non-2xx or timeout). consecutive_failure_count: type: integer description: >- Consecutive failures since last success. 5+ consecutive failures auto-pauses the endpoint. last_delivery_at: type: string format: date-time nullable: true created_at: type: string format: date-time metadata: type: object description: Arbitrary key-value pairs stored by the creator. ErrorEnvelope: type: object description: | Canonical error response envelope. All API errors use this shape. required: - error - code properties: error: type: string description: Machine-readable error key example: not_found code: type: string description: Machine-readable error code (often same as error) example: not_found type: type: string enum: - validation_error - permission_error - not_found - conflict - rate_limit - internal - expand_error - not_implemented example: not_found hint: type: string description: Human-readable one-sentence explanation (English) example: >- The requested order does not exist or does not belong to this entity. param: type: string description: The parameter that caused the error, if applicable example: expand[0] required: type: string description: The scope required (only on insufficient_scope errors) example: accounts:read request_id: type: string description: >- Unique request ID for support tracing (maps to CloudWatch log stream) example: req_abc123 responses: Error: description: Error response (400/401/403/404/409/422/429/500) content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: ApiKeyAuth: type: http scheme: bearer description: | API key issued per entity via Settings > Developers > API Keys. Each key carries scopes (e.g. orders:read, products:write). Bearer token format: Authorization: Bearer ark_live_ent__ Test keys use ark_test_ent__. Both are issued per entity via Settings > Developers > API Keys. ````