> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truscan.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Add an endpoint

> The response is the only time the signing secret is readable.



## OpenAPI

````yaml /api-reference/webhooks.json post /api/webhooks
openapi: 3.1.0
info:
  title: truscan webhooks
  version: 1.0.0
  description: >-
    Outbound event delivery. Customers register an endpoint, choose events, and
    receive signed POSTs.


    Every delivery carries `Truscan-Signature: t=<unix>,v1=<hex>`, where the hex
    is HMAC-SHA256 of `<timestamp>.<raw body>` keyed with the endpoint's signing
    secret. The timestamp is inside the signed material, so a captured delivery
    cannot be replayed with a fresh one. Compare with a constant-time function,
    and reject a timestamp outside your tolerance.


    A 2xx marks the delivery done. Anything else is retried at 30s, 2m, 10m, 45m
    and 2h, after which it is abandoned. Return 410 Gone to stop delivery
    permanently.
servers:
  - url: https://api.truscan.co
security:
  - bearerAuth: []
paths:
  /api/webhooks:
    post:
      summary: Add an endpoint
      description: The response is the only time the signing secret is readable.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - url
                - events
              properties:
                url:
                  type: string
                  format: uri
                  example: https://example.com/hooks/truscan
                events:
                  type: array
                  items:
                    type: string
                  example:
                    - credits.low
                description:
                  type: string
      responses:
        '201':
          description: Created, with the signing secret
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
                  result:
                    $ref: '#/components/schemas/CreatedEndpoint'
        '400':
          $ref: '#/components/responses/Failure'
        '401':
          $ref: '#/components/responses/Failure'
        '409':
          $ref: '#/components/responses/Failure'
components:
  schemas:
    CreatedEndpoint:
      allOf:
        - $ref: '#/components/schemas/Endpoint'
        - type: object
          properties:
            secret:
              type: string
              example: whsec_…
              description: Shown once. Store it now; it cannot be read again.
    Endpoint:
      type: object
      properties:
        id:
          type: string
          example: whe_9f2c…
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
        enabled:
          type: boolean
        description:
          type: string
        created_at:
          type: string
          format: date-time
  responses:
    Failure:
      description: A handled failure. Never a 200.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              message:
                type: string
              result:
                type: object
                properties:
                  code:
                    type: string
                    example: validation_failed
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: A dashboard session cookie or a tru_ API key.

````