# Create a sync webhook

> Add a webhook to a sync. When an event of the `notification_type` happens, Stacksync posts the event as JSON to the URL with `Authorization: Bearer <api_key>`. The URL is checked to be reachable before the webhook is stored. Send `validate_only: true` to run the checks without storing.

Source: https://docs.stacksync.com/api-reference/syncs/webhooks/create_sync_webhook

`POST https://api.stacksync.com/v1/workspaces/{workspace_id}/bases/{base_id}/webhooks`

- Operation: `create_sync_webhook`
- Resource: Sync webhooks
- Access: writes data

## Authentication

- `Authorization: Bearer <key>`: A workspace API key (workspace_…, created by a workspace owner under Workspace settings > Stacksync API) acts with editor rights on that workspace only; a user API key (user_…, created under Profile > Stacksync API) acts as that user in every workspace they belong to. POST, PUT and PATCH requests must send Content-Type: application/json. Every authentication failure answers 403.
- `Content-Type: application/json` on every request with a body.

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | integer | Yes | The workspace the resources belong to |
| `base_id` | string (uuid) | Yes | The sync (a sync is called a base in these paths) |

## Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `region` | string (besg \| usnv) | Yes | Data region of the sync |

## Request body

`application/json`. The webhook to add. The example's host hooks.example.com is a placeholder: replace it with your own HTTPS endpoint; it must resolve publicly.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | string (uri) | Yes | The https URL Stacksync posts the notification to: a public internet host that answers an OPTIONS request within 2 seconds, with none of the characters space < > # % { } \| \ ^ ~ [ ] ` |
| `notification_type` | string (base_activity \| real_time_issue_notification \| backfill) | Yes | `base_activity` (the sync was switched, edited or failed), `real_time_issue_notification` (records failed to sync) or `backfill` (an initial full read finished) |
| `api_key` | string | Yes | Sent as `Authorization: Bearer <api_key>` with every notification, so your endpoint can check the caller |
| `validate_only` | boolean, default false | No | Run every check of the write and answer without writing: a refused write answers the error it would answer |

## Returns

### 200 The webhook created

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `msg` | string | Yes | What was done |
| `webhook` | object (SyncWebhook) | Yes | A webhook of the sync |
| `webhook.webhook_id` | string (uuid) | Yes | The webhook |
| `webhook.url` | string (uri) | Yes | The https URL Stacksync posts the notification to: a public internet host that answers an OPTIONS request within 2 seconds, with none of the characters space < > # % { } \| \ ^ ~ [ ] ` |
| `webhook.notification_type` | string (base_activity \| real_time_issue_notification \| backfill) | Yes | `base_activity` (the sync was switched, edited or failed), `real_time_issue_notification` (records failed to sync) or `backfill` (an initial full read finished) |
| `webhook.api_key` | string | Yes | Sent as `Authorization: Bearer <api_key>` with every notification, so your endpoint can check the caller |

### 204 Every check passed and nothing was written (`validate_only: true`)

No body.

## Example request

```bash
curl -X POST "https://api.stacksync.com/v1/workspaces/{workspace_id}/bases/{base_id}/webhooks?region=besg" \
  -H "Authorization: Bearer $STACKSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://hooks.example.com/stacksync",
  "notification_type": "real_time_issue_notification",
  "api_key": "whsec_7f3a9c2e4b1d"
}'
```

`hooks.example.com` is a placeholder: replace it with your own host, which the API checks before saving (the example as written is refused).

## Example response (200)

```json
{
  "msg": "Successfully created webhook",
  "webhook": {
    "webhook_id": "6a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
    "url": "https://hooks.example.com/stacksync",
    "notification_type": "real_time_issue_notification",
    "api_key": "whsec_7f3a9c2e4b1d"
  }
}
```

## Errors

| Status | Meaning | Body |
| --- | --- | --- |
| 400 | The `region` is missing or not one of besg, usnv; the body is not valid JSON; `base_id` is not a UUID; `url` is not an https URL on a public internet host, holds an unsafe character or did not answer within 2 seconds, `notification_type` is not one of the three types, `api_key` is empty (`Error validating webhook`); the sync already has a webhook of this type to this URL (`Duplicate webhook`); the webhook could not be stored (`Error creating webhook`) | `{ "error": string }` |
| 403 | Forbidden: invalid API key, API key of another workspace, insufficient scope, workspace unavailable, or a non-GET request without `Content-Type: application/json` | `{ "error": string }` |
| 404 | No sync with this id exists in the workspace (`Error creating webhook`: `Sync does not exist.`) | `{ "error": string }` |

## Related

- [API Reference overview](https://docs.stacksync.com/api-reference): base URLs, regions, pagination, idempotency and errors
- [Authentication](https://docs.stacksync.com/api-reference/authentication): API keys and the 403 answers
- OpenAPI document: https://docs.stacksync.com/openapi.json
- [List sync webhooks](https://docs.stacksync.com/api-reference/syncs/webhooks/list_sync_webhooks)
- [Get a sync webhook](https://docs.stacksync.com/api-reference/syncs/webhooks/get_sync_webhook)
- [Update a sync webhook](https://docs.stacksync.com/api-reference/syncs/webhooks/update_sync_webhook)
- [Delete a sync webhook](https://docs.stacksync.com/api-reference/syncs/webhooks/delete_sync_webhook)