> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverwhale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Webhook Subscription

> Register an HTTPS endpoint to receive events for your account's submissions. **The signing `secret` is returned only in this response (and on rotate-secret) — store it now; it is never shown again.** Use it to verify the signature on every delivery.

Subscriptions are scoped to your account: you only ever receive events for submissions your company owns.



## OpenAPI

````yaml post /webhook-subscriptions
openapi: 3.0.0
info:
  title: Cover Whale API V1
  contact:
    name: Cover Whale API Team
  version: '1.0'
servers:
  - url: https://api.coverwhale.dev/v1
security:
  - AccessToken: []
tags:
  - name: Authentication
    description: Authenticating & Interacting with the API
paths:
  /webhook-subscriptions:
    post:
      tags:
        - Webhooks
      summary: Create a Webhook Subscription
      description: >-
        Register an HTTPS endpoint to receive events for your account's
        submissions. **The signing `secret` is returned only in this response
        (and on rotate-secret) — store it now; it is never shown again.** Use it
        to verify the signature on every delivery.


        Subscriptions are scoped to your account: you only ever receive events
        for submissions your company owns.
      operationId: createWebhookSubscription
      parameters:
        - name: Content-Type
          in: header
          required: true
          schema:
            type: string
          example: application/json
        - name: Accept
          in: header
          required: true
          schema:
            type: string
          example: application/json
        - name: AccessToken
          in: header
          required: true
          schema:
            type: string
          example: eyJraWQiOiJnRk5oTTh2RnRKWXVDVXU1S........
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - endpoint_url
                - event_types
              properties:
                endpoint_url:
                  description: Your HTTPS receiver URL. Must start with https://.
                  type: string
                  example: https://hooks.yourapp.com/coverwhale
                event_types:
                  description: >-
                    One or more event types to receive. Must contain at least
                    one.
                  type: array
                  minItems: 1
                  items:
                    type: string
                    enum:
                      - submission.quoted
                      - submission.bind_completed
                      - submission.endorsement_bound
                      - submission.renewed
                      - submission.pending_cancellation
                      - submission.canceled
                      - submission.reinstated
                      - submission.public_reply
                  example:
                    - submission.bind_completed
                    - submission.canceled
                    - submission.public_reply
      responses:
        '201':
          description: Subscription created — `secret` is included here only
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                    example: 42
                  company_id:
                    type: integer
                    example: 6042
                  endpoint_url:
                    type: string
                    example: https://hooks.yourapp.com/coverwhale
                  event_types:
                    type: array
                    items:
                      type: string
                    example:
                      - submission.bind_completed
                      - submission.canceled
                  active:
                    type: boolean
                    example: true
                  secret:
                    type: string
                    description: Signing secret — shown only here and on rotate-secret.
                    example: whsec_9f2c1e7a4b6d...
                  secret_rotated_at:
                    type: string
                    format: date-time
                    nullable: true
                    example: null
                  created_at:
                    type: string
                    format: date-time
                    example: '2026-07-14T12:00:00+00:00'
                  updated_at:
                    type: string
                    format: date-time
                    example: '2026-07-14T12:00:00+00:00'
        '422':
          description: Validation error (missing/invalid endpoint_url or event_types)
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  errors:
                    type: object
                example:
                  message: The endpoint url must start with https://.
                  errors:
                    endpoint_url:
                      - The endpoint url must start with https://.
components:
  securitySchemes:
    AccessToken:
      type: apiKey
      description: >-
        AWS Cognito access token obtained from the /authentication endpoint.
        Token expires after 3600 seconds.
      name: AccessToken
      in: header

````