> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scripxhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a webhook

> Register a ScripX webhook endpoint and receive the HMAC signing secret exactly once, subscribing to one event or the full catalog.

Registers a URL for signed event deliveries. Requires the `webhooks:write` scope. Returns `201` with the webhook record, the event catalog, and your `signing_secret`, **shown exactly once**.

### Request example

```bash theme={"dark"}
curl -X POST "https://api.scripxhq.com/v1/webhooks" \
  -H "X-ScripX-Key: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/hooks/scripx", "event": "*"}'
```

`url` is required and must be HTTPS in production. `event` is one catalog event or `*` for all; an unknown event name is a `400` listing the valid catalog.

### Response example

```json theme={"dark"}
{
  "registered": true,
  "webhook": {"webhook_id": "wh_01HZZ…", "url": "https://example.com/hooks/scripx", "event": "*"},
  "signing_secret": "whsec_9f2…",
  "events": ["order.matched", "settlement.settled", "settlement.failed", "credit.issued", "payout.sent", "settlement.updated"]
}
```

Store the secret now; every later view is masked. Verification code is in the [Webhooks guide](/webhooks).

### Errors

* `400 bad_request`, unknown event name (the message lists the catalog).
* `422 unprocessable`, missing or non-HTTPS `url`.

**Terms used here:** [order](/annexure/terminology#order), [API key](/annexure/terminology#api-key), [scope](/annexure/terminology#scope), [webhook](/annexure/terminology#webhook), [dead-letter](/annexure/terminology#dead-letter-and-replay). Full list in the [terminology annexure](/annexure/terminology).

### Next steps

* [Webhook events](/annexure/webhook-events), what each event means.
* [Failures](/api-reference/webhooks/failures) and [replay](/api-reference/webhooks/replay).


## OpenAPI

````yaml POST /v1/webhooks
openapi: 3.1.0
info:
  title: ScripX Partner API
  version: 1.2.0
  description: >-
    Automate duty-credit-scrip trading: quote, order, positions, market,
    webhooks. Auth: `X-ScripX-Key: scripx_live_…`. Money = integer paise; price
    = bps of face.
  contact:
    name: ScripX API Support
    email: amin@eximfiles.io
    url: https://scripxhq.com
servers:
  - url: https://api.scripxhq.com
    description: >-
      Production and sandbox share one host; a scripx_test_ key selects the
      sandbox.
security:
  - ApiKeyAuth: []
tags:
  - name: Firms
    description: >-
      client-firm lifecycle: register, verify, authorize, credits, update,
      offboard
  - name: Trading
    description: quote, orders, positions, market
  - name: Group
    description: intra-group netting + positions (enterprise/broker)
  - name: Cross
    description: 'broker cross-desk: block deals + intra-group transfers'
  - name: Webhooks
    description: event subscriptions + delivery
  - name: Account
    description: usage + metering
  - name: Keys
    description: self-serve scoped child keys (sub-accounts)
paths:
  /v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Register a webhook (returns the signing secret once)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookRequest'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookRegistered'
        '401':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - ApiKeyAuth: []
components:
  schemas:
    WebhookRequest:
      type: object
      required:
        - url
      properties:
        url:
          type: string
          format: uri
        event:
          type: string
    WebhookRegistered:
      type: object
      properties:
        registered:
          type: boolean
        webhook:
          type: object
        signing_secret:
          type: string
          description: shown ONCE at registration
        events:
          type: array
          items:
            type: string
    Error:
      type: object
      properties:
        error:
          type: string
        code:
          type: string
          description: stable machine code
          enum:
            - bad_request
            - unauthorized
            - forbidden
            - not_found
            - conflict
            - unprocessable
            - rate_limited
            - internal
        message:
          type: string
        detail:
          type: object
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-ScripX-Key
      description: >-
        Your API key, e.g. `scripx_live_…`. Bound to one firm; tenant isolation
        is enforced.

````