> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook endpoint

> Creates a webhook endpoint that will receive notifications for the given `enabled_events`. The endpoint is created in the `live` or `test` mode of the API key used. The response includes the signing `secret` used to verify webhook payloads. Fintoc returns the `secret` only on creation, so store it securely.

**`v1`** · Base URL `https://api.fintoc.com/v1`


## OpenAPI

````yaml reference/fintoc-api.json POST /webhook_endpoints
openapi: 3.1.0
info:
  title: fintoc-api
  version: v2026-02-01
servers:
  - url: https://api.fintoc.com/v1
security: []
paths:
  /webhook_endpoints:
    post:
      tags:
        - Webhook endpoints
      summary: Create a webhook endpoint
      description: >-
        Creates a webhook endpoint that will receive notifications for the given
        `enabled_events`. The endpoint is created in the `live` or `test` mode
        of the API key used. The response includes the signing `secret` used to
        verify webhook payloads. Fintoc returns the `secret` only on creation,
        so store it securely.
      operationId: webhook-endpoints-create
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                enabled_events:
                  type: array
                  items:
                    type: string
                    enum:
                      - link.credentials_changed
                      - link.refresh_intent.succeeded
                      - link.refresh_intent.failed
                      - account.refresh_intent.succeeded
                      - account.refresh_intent.failed
                      - account.refresh_intent.rejected
                      - payment_intent.succeeded
                      - payment_intent.rejected
                      - payment_intent.failed
                      - payment_intent.pending
                      - payment_intent.expired
                      - subscription.activated
                      - subscription.canceled
                      - subscription_intent.succeeded
                      - subscription_intent.rejected
                      - subscription_intent.failed
                      - charge.succeeded
                      - charge.failed
                      - account.refresh_intent.movements_removed
                      - account.refresh_intent.movements_modified
                      - refund.succeeded
                      - refund.failed
                      - refund.in_progress
                      - payout.created
                      - payout.canceled
                      - payout.succeeded
                      - payout.returned
                      - checkout_session.finished
                      - checkout_session.expired
                      - transfer.inbound.succeeded
                      - transfer.outbound.succeeded
                      - transfer.outbound.failed
                      - transfer.outbound.returned
                      - transfer.inbound.returned
                      - transfer.inbound.return_failed
                      - account_number.deleted
                      - account_verification.succeeded
                      - account_verification.failed
                      - transfer.inbound.rejected
                      - payment_method.activated
                      - payment_method.canceled
                      - invoice.created
                      - invoice.finalized
                      - invoice.payment_created
                      - invoice.payment_failed
                      - invoice.payment_succeeded
                      - invoice.voided
                      - dispute.waiting_documentation
                      - dispute.in_review
                      - dispute.won
                      - dispute.lost
                      - dispute.expired
                      - entity.onboarding.approved
                      - entity.onboarding.rejected
                  example:
                    - link.credentials_changed
                  description: Events that will trigger a webhook to be sent.
                url:
                  type: string
                  example: https://my.webhook.endpoint
                  description: HTTPS URL that will receive the notifications about events.
                description:
                  type: string
                  example: Webhook endpoint for payment events.
                  description: >-
                    Optional description that might help identify the
                    responsibilities of the endpoint.
                name:
                  type: string
                  example: My webhook endpoint
                  description: Optional name to identify the endpoint.
              required:
                - url
                - enabled_events
            examples:
              create_webhook_endpoint:
                summary: Create a webhook endpoint
                value:
                  enabled_events:
                    - link.credentials_changed
                  url: https://my.webhook.endpoint
                  description: Webhook endpoint for payment events.
                  name: My webhook endpoint
      responses:
        '201':
          description: >-
            Webhook endpoint created. The signing `secret` is only returned in
            this response.
          content:
            application/json:
              examples:
                webhook_endpoint_created:
                  value:
                    id: we_M6yrvOepCe3Rqp8B
                    object: webhook_endpoint
                    created_at: '2021-05-17T17:04:10.284Z'
                    description: Webhook endpoint for payment events.
                    enabled_events:
                      - link.credentials_changed
                    mode: live
                    name: My webhook endpoint
                    secret: whsec_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ
                    status: enabled
                    url: https://my.webhook.endpoint
              schema:
                $ref: '#/components/schemas/webhook_endpoint'
        '400':
          description: >-
            Invalid request: the `url` is missing, empty or not HTTPS, or
            `enabled_events` is missing.
          content:
            application/json:
              examples:
                invalid_url:
                  value:
                    error:
                      type: invalid_request_error
                      code: invalid_url
                      param: url
                      message: >-
                        Invalid HTTPS url: http://my.webhook.endpoint. Please
                        provide a valid HTTPS url.
                      doc_url: https://docs.fintoc.com/reference/errors
              schema:
                $ref: '#/components/schemas/error_object'
        '401':
          description: Invalid or missing API key.
          content:
            application/json:
              examples:
                invalid_api_key:
                  value:
                    error:
                      type: authentication_error
                      code: invalid_api_key
                      message: 'Invalid API Key: invalid-*oken'
              schema:
                $ref: '#/components/schemas/error_object'
        '404':
          description: One of the `enabled_events` does not exist.
          content:
            application/json:
              examples:
                missing_event:
                  value:
                    error:
                      type: invalid_request_error
                      code: missing_resource
                      param: enabled_events
                      message: 'No such event: invalid_event'
                      doc_url: https://docs.fintoc.com/reference/errors
              schema:
                $ref: '#/components/schemas/error_object'
      security:
        - api_key: []
components:
  schemas:
    webhook_endpoint:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the webhook endpoint.
          example: we_M6yrvOepCe3Rqp8B
        object:
          const: webhook_endpoint
          description: Type of the object. Always `webhook_endpoint`.
        created_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp of when the webhook endpoint was created.
          example: '2021-05-17T17:04:10.284Z'
        description:
          type:
            - string
            - 'null'
          description: Optional free-text description of the endpoint.
          example: Webhook endpoint for payment events.
        enabled_events:
          type: array
          description: Event types that trigger a notification to this endpoint.
          items:
            type: string
            enum:
              - link.credentials_changed
              - link.refresh_intent.succeeded
              - link.refresh_intent.failed
              - account.refresh_intent.succeeded
              - account.refresh_intent.failed
              - account.refresh_intent.rejected
              - payment_intent.succeeded
              - payment_intent.rejected
              - payment_intent.failed
              - payment_intent.pending
              - payment_intent.expired
              - subscription.activated
              - subscription.canceled
              - subscription_intent.succeeded
              - subscription_intent.rejected
              - subscription_intent.failed
              - charge.succeeded
              - charge.failed
              - account.refresh_intent.movements_removed
              - account.refresh_intent.movements_modified
              - refund.succeeded
              - refund.failed
              - refund.in_progress
              - payout.created
              - payout.canceled
              - payout.succeeded
              - payout.returned
              - checkout_session.finished
              - checkout_session.expired
              - transfer.inbound.succeeded
              - transfer.outbound.succeeded
              - transfer.outbound.failed
              - transfer.outbound.returned
              - transfer.inbound.returned
              - transfer.inbound.return_failed
              - account_number.deleted
              - account_verification.succeeded
              - account_verification.failed
              - transfer.inbound.rejected
              - payment_method.activated
              - payment_method.canceled
              - invoice.created
              - invoice.finalized
              - invoice.payment_created
              - invoice.payment_failed
              - invoice.payment_succeeded
              - invoice.voided
              - dispute.waiting_documentation
              - dispute.in_review
              - dispute.won
              - dispute.lost
              - dispute.expired
              - entity.onboarding.approved
              - entity.onboarding.rejected
            example: link.credentials_changed
        mode:
          $ref: '#/components/schemas/mode'
        name:
          type:
            - string
            - 'null'
          description: Optional name to identify the endpoint.
          example: My webhook endpoint
        secret:
          type:
            - string
            - 'null'
          description: >-
            Secret used to verify the signature of the webhooks sent to the
            endpoint. Only returned when the endpoint is created; `null` in
            every other response.
          example: whsec_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ
        status:
          type: string
          enum:
            - disabled
            - enabled
          description: Whether the endpoint currently receives event notifications.
          example: enabled
        url:
          type: string
          description: HTTPS URL that receives the event notifications.
          example: https://my.webhook.endpoint
      required:
        - id
        - object
        - description
        - url
        - status
        - mode
        - secret
        - enabled_events
        - created_at
        - name
    error_object:
      type: object
      properties:
        error:
          type: object
          description: Details of the error that caused the request to fail.
          properties:
            code:
              type: string
              description: >-
                Machine-readable code identifying the specific error, for
                example `invalid_api_key`. Not returned by every error.
              example: invalid_api_key
            doc_url:
              type: string
              description: >-
                URL of a documentation page with more details about the error.
                Not returned by every error.
              example: https://docs.fintoc.com/reference/errors
            message:
              type: string
              description: Human-readable message describing the error.
              example: 'Invalid API Key: invalid-*oken'
            param:
              type:
                - string
                - 'null'
              description: >-
                Name of the request parameter that caused the error. `null` when
                the error cannot be tied to a single parameter, and not returned
                by every error.
              example: amount
            type:
              type: string
              description: >-
                Category of the error, for example `invalid_request_error`,
                `authentication_error`, or `api_error`.
              example: invalid_request_error
          required:
            - type
            - message
    mode:
      type: string
      enum:
        - test
        - live
      description: >-
        Mode of the object. `live` objects use real institution data, `test`
        objects use fake data for integration testing.
      example: live
  securitySchemes:
    api_key:
      type: apiKey
      name: Authorization
      in: header

````