> ## Documentation Index
> Fetch the complete documentation index at: https://docs.papp.sa/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook

> Registers a new webhook for the authenticated merchant.



## OpenAPI

````yaml /openapi/points-api-v1.yaml post /v1/webhooks
openapi: 3.0.3
info:
  title: Points API
  version: 1.0.0
  description: >
    OpenAPI definition for the `/api/v1` endpoints defined in
    `routes/api_v1.php`. This spec reflects the behaviour of the Laravel backend
    and is the source of truth for integrators.
  contact:
    name: Points API Support
    email: support@papp.sa
    url: https://docs.papp.sa
servers:
  - url: https://business.papp.sa/api
    description: Production server
  - url: https://sandbox.papp.sa/api
    description: Sandbox server
security:
  - ApiKeyAuth: []
tags:
  - name: Orders
    description: Operations for creating and managing orders
  - name: Webhooks
    description: CRUD operations for merchant webhooks
  - name: Integration
    description: External-platform toggle state (e.g. Matajer's "ربط بوينتس" switch)
paths:
  /v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Create a webhook
      description: Registers a new webhook for the authenticated merchant.
      operationId: createWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookRequest'
      responses:
        '200':
          description: Webhook created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
        '400':
          description: Validation failed or webhook already exists for this URL.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          $ref: '#/components/responses/ValidationError'
components:
  schemas:
    WebhookRequest:
      type: object
      required:
        - name
        - url
      properties:
        name:
          type: string
          maxLength: 255
          example: Order Notification
        url:
          type: string
          format: uri
          maxLength: 500
          example: https://merchant.example.com/webhooks/orders
    WebhookResponse:
      allOf:
        - $ref: '#/components/schemas/ApiMetadata'
        - type: object
          required:
            - data
          properties:
            data:
              $ref: '#/components/schemas/WebhookBase'
    ErrorResponse:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: false
        message:
          type: string
          example: Invalid or inactive API key
        appended_data:
          type: object
          additionalProperties: true
          example: {}
    ApiMetadata:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: true
        message:
          type: string
          nullable: true
          example: ''
        appended_data:
          type: object
          additionalProperties: true
          example: {}
    WebhookBase:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
          example: 550e8400-e29b-41d4-a716-446655440000
        merchant_id:
          type: integer
          example: 123
        name:
          type: string
          example: Order Notification
        url:
          type: string
          format: uri
          example: https://merchant.example.com/webhooks/orders
        secret:
          type: string
          description: >
            Signing secret, returned on every read (not just on create). Used to
            verify the `X-Webhook-Secret` header in delivered events.
          example: abc123def456
        created_at:
          type: string
          format: date-time
          example: '2024-12-23T10:00:00.000Z'
        updated_at:
          type: string
          format: date-time
          example: '2024-12-23T15:30:00.000Z'
    ValidationErrorResponse:
      type: object
      required:
        - status
        - message
        - appended_data
      properties:
        status:
          type: boolean
          example: false
        message:
          type: string
          example: The given data was invalid.
        appended_data:
          type: object
          additionalProperties: true
          example: {}
        errors:
          type: object
          description: >
            Field-level validation errors. Keys are field names (dot-notation
            for nested fields, e.g. `products.0.product_price`). Values are
            arrays of error message strings.
          additionalProperties:
            type: array
            items:
              type: string
          example:
            total_price:
              - The total price field is required.
            products.0.quantity:
              - The quantity must be at least 1.
  responses:
    Forbidden:
      description: >
        The authenticated merchant is not allowed to perform this action (e.g.
        merchant is unverified, or the feature is disabled on this account).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ValidationError:
      description: Request body failed validation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationErrorResponse'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key

````