> ## Documentation Index > Fetch the complete documentation index at: https://redbark.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Add a webhook endpoint > Adds an https endpoint that gets a signed POST for each chosen event. Returns the signing secret once. A firm can have up to 16 endpoints. Only an admin can call this. ## OpenAPI ````yaml /openapi/advisor.json post /webhook-endpoints openapi: 3.1.0 info: title: Redbark Advisor API version: 2.0.0 description: >- Read and write access to one advice firm in Redbark Advisor: clients, checklists, documents, money, messages, reports, team and webhooks. Send an API key or a connected app’s access token as a bearer token. A credential carries scopes, one read and one write per area, and each call says the scope it needs. A write scope brings its read scope. Each key may make 120 requests a minute. servers: - url: https://advisor.redbark.com/api/v1 security: - bearerAuth: [] tags: - name: Firm description: The firm, its name and its branding. - name: Team description: Team members and their roles. - name: Clients description: Clients, their people and portal invites. - name: Checklists description: Checklist templates, the checklists sent to clients and their answers. - name: Documents description: Documents clients upload and the details read from them. - name: Money description: Bank connections, accounts, balances and transactions. - name: Document types description: Document types, their fields and the client facts they fill. - name: Messages description: Messages between the firm and clients. - name: Reports description: Reports exported for clients. - name: Webhooks description: Webhook endpoints and their deliveries. - name: Webhook events description: Events sent to your webhook endpoints. paths: /webhook-endpoints: post: tags: - Webhooks summary: Add a webhook endpoint description: >- Adds an https endpoint that gets a signed POST for each chosen event. Returns the signing secret once. A firm can have up to 16 endpoints. Only an admin can call this. operationId: create_webhook_endpoint parameters: [] requestBody: required: true content: application/json: schema: type: object properties: url: type: string minLength: 1 maxLength: 2048 description: An https URL that answers POST requests from the internet. events: type: array items: type: string maxLength: 100 minItems: 1 maxItems: 48 description: >- Webhook event types from list_event_types, or ["*"] for all of them: client.created, client.invited, client.joined, checklist.sent, checklist.item_submitted, checklist.item_changes_requested, checklist.completed, document.uploaded, fact.accepted, account.connected, account.disconnected, message.created. description: anyOf: - anyOf: - type: string maxLength: 200 - type: 'null' description: A note for the firm about what the endpoint is for. - type: 'null' required: - url - events responses: '201': description: Created. content: application/json: schema: $ref: '#/components/schemas/WebhookEndpointWithSecret' '400': description: The request is not valid. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: The API key or access token is missing, wrong, expired or revoked. content: application/json: schema: $ref: '#/components/schemas/Error' '402': description: >- subscription_required: the firm has no active subscription, so it cannot add or invite clients or send checklists. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- The credential lacks the scope this call needs, the call is for admins only, or the member it acts as has left the firm. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such resource in this firm. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The resource is in a state that does not allow this, such as an archived client, or client_limit_reached: the plan’s 20 active clients are in use. content: application/json: schema: $ref: '#/components/schemas/Error' '413': description: The request body is too large. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Too many requests. See the Retry-After header. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Something went wrong on our side. Try again. content: application/json: schema: $ref: '#/components/schemas/Error' security: - bearerAuth: - webhooks:write components: schemas: WebhookEndpointWithSecret: type: object properties: object: type: string enum: - webhook_endpoint endpoint: $ref: '#/components/schemas/WebhookEndpoint' secret: type: string description: 'The signing secret. Store it now: it is not shown again.' required: - object - endpoint - secret additionalProperties: true Error: type: object properties: error: type: object properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - rate_limit_error - api_error code: type: string message: type: string param: anyOf: - type: string - type: 'null' request_id: type: string required: - type - code - message - param - request_id additionalProperties: true required: - error additionalProperties: true WebhookEndpoint: type: object properties: object: type: string enum: - webhook_endpoint id: type: string url: type: string description: anyOf: - type: string - type: 'null' events: type: array items: type: string status: type: string enum: - active - failing - disabled description: >- active, failing (every delivery has failed for a day or 20 in a row) or disabled (turned off by a member or after 3 days of failures). disabled_reason: anyOf: - type: string enum: - member - failing - type: 'null' secret_hint: type: string description: >- The secret’s prefix and last four characters. The full secret is never shown again. previous_secret_expires_at: anyOf: - type: string description: An ISO 8601 time in UTC. - type: 'null' description: >- While set, requests are also signed with the secret before the last roll. created_at: type: string description: An ISO 8601 time in UTC. last_delivery: anyOf: - type: object properties: status: type: string enum: - pending - succeeded - failed response_status: anyOf: - type: number - type: 'null' at: type: string description: An ISO 8601 time in UTC. required: - status - response_status - at additionalProperties: true - type: 'null' required: - object - id - url - description - events - status - disabled_reason - secret_hint - previous_secret_expires_at - created_at - last_delivery additionalProperties: true securitySchemes: bearerAuth: type: http scheme: bearer description: >- A firm API key, shown once when it is made, or a connected app’s OAuth access token. Each operation lists the scope it needs, such as clients:write. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.