> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unifystays.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Webhook Endpoint

> Register a webhook URL and receive its one-time signing secret.

Create an endpoint for the environment associated with your API key. Use
individual event names or `booking.*` to receive every booking event.

<Warning>
  The `signing_secret` is returned only once. Store it securely before
  discarding the response.
</Warning>

Production endpoints must use a public HTTPS URL. The endpoint starts in
`ACTIVE` status.


## OpenAPI

````yaml reference/openapi.json POST /webhooks/endpoints
openapi: 3.0.0
info:
  title: Unifystays API
  description: >-
    One unified hotel API across suppliers. Integrate once, then enable and
    manage suppliers from the Unifystays portal.
  version: '1.0'
  contact: {}
servers:
  - url: https://api-sandbox.unifystays.com
    description: Sandbox
  - url: https://api.unifystays.com
    description: Production
security:
  - x-api-key: []
tags: []
paths:
  /webhooks/endpoints:
    post:
      tags:
        - Webhooks
      summary: Create a webhook endpoint
      description: >-
        Registers a delivery URL for the current organization. The signing
        secret is shown once and must be stored securely.
      operationId: WebhookController_createEndpoint
      parameters:
        - name: language
          description: Enter language code(ex. en)
          in: header
          schema: {}
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookEndpointDto'
      responses:
        '201':
          description: The signing secret is returned only in this response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointCreatedResponseDto'
components:
  schemas:
    CreateWebhookEndpointDto:
      type: object
      properties:
        name:
          type: string
          description: Human-readable name shown in webhook logs and the portal.
          example: Production booking events
          minLength: 1
          maxLength: 120
        url:
          type: string
          description: >-
            Public HTTPS URL that receives webhook POST requests. Private,
            loopback, link-local, and internal hosts are rejected.
          example: https://example.com/webhooks/unifystays
          minLength: 8
          maxLength: 2048
        event_types:
          type: array
          description: >-
            Event types delivered to this endpoint. Use booking.* to subscribe
            to every booking event.
          example:
            - booking.confirmed
            - booking.cancelled
          minItems: 1
          maxItems: 20
          items:
            type: string
            enum:
              - booking.created
              - booking.confirmed
              - booking.failed
              - booking.cancellation_requested
              - booking.cancelled
              - booking.cancellation_failed
              - booking.*
      required:
        - name
        - url
        - event_types
    WebhookEndpointCreatedResponseDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 8b95a9e0-4af3-4c6d-92df-84b64256d27f
          description: Unique webhook endpoint identifier.
        name:
          type: string
          example: Production booking events
          description: Human-readable endpoint name.
        url:
          type: string
          format: uri
          example: https://example.com/webhooks/unifystays
          description: URL that receives signed webhook POST requests.
        status:
          type: string
          enum:
            - ACTIVE
            - PAUSED
            - DISABLED
          example: ACTIVE
          description: >-
            Current endpoint state. Paused and disabled endpoints do not receive
            new deliveries.
        event_types:
          type: array
          example:
            - booking.confirmed
            - booking.cancelled
          description: Normalized event subscriptions for this endpoint.
          items:
            type: string
            enum:
              - booking.created
              - booking.confirmed
              - booking.failed
              - booking.cancellation_requested
              - booking.cancelled
              - booking.cancellation_failed
              - booking.*
        consecutive_failures:
          type: number
          example: 0
          description: >-
            Consecutive delivery failures since the last success or
            reactivation.
        last_success_at:
          type: string
          format: date-time
          nullable: true
          example: '2026-08-08T08:30:00.000Z'
          description: Time of the most recent successful delivery, if any.
        last_failure_at:
          type: string
          format: date-time
          nullable: true
          example: null
          description: Time of the most recent failed delivery, if any.
        disabled_at:
          type: string
          format: date-time
          nullable: true
          example: null
          description: Time the endpoint was disabled, if applicable.
        disabled_reason:
          type: string
          nullable: true
          example: null
          description: Reason the endpoint was disabled, if applicable.
        created_at:
          type: string
          format: date-time
          example: '2026-08-08T08:00:00.000Z'
          description: Endpoint creation time.
        updated_at:
          type: string
          format: date-time
          example: '2026-08-08T08:30:00.000Z'
          description: Time the endpoint was last updated.
        signing_secret:
          type: string
          example: whsec_************************
          description: >-
            HMAC signing secret. Returned only once; store it securely before
            discarding the response.
      required:
        - id
        - name
        - url
        - status
        - event_types
        - consecutive_failures
        - last_success_at
        - last_failure_at
        - disabled_at
        - disabled_reason
        - created_at
        - updated_at
        - signing_secret
  securitySchemes:
    x-api-key:
      type: apiKey
      in: header
      name: x-api-key
      description: Environment-specific API key created in the Unifystays portal

````