> ## Documentation Index > Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook subscription > Registers an outbound webhook endpoint for the organization. Every matching activity event is delivered as a signed HTTP POST to the target URL. The HMAC signing secret is generated server-side and returned ONCE in the response (in the `secret` field); it is never retrievable again, so store it immediately. Subsequent reads expose only a `secretHint` (last four characters). The URL is validated against an SSRF guard and must be https:// in production. Requires a Nevermined API key. Requires organization admin privileges. Requires the organization to be on the Premium tier or higher. ## OpenAPI ````yaml /api-reference/organizations-openapi.json post /organizations/{orgId}/webhooks openapi: 3.0.0 info: title: Nevermined Organizations API description: >- Manage a Nevermined organization programmatically — members, tiers, groups & budgets, treasury wallets, customers, webhooks, analytics, and agent-discovery surfaces. version: 1.0.0 contact: {} servers: - url: https://api.sandbox.nevermined.app/api/v1 description: Sandbox - url: https://api.live.nevermined.app/api/v1 description: Live security: [] tags: - name: Organizations x-group: General description: Organization settings, members & roles, and workspace context. - name: Organizations - Billing x-group: Billing description: Tiers, subscriptions, invoices, checkout, and the public tier catalog. - name: Groups x-group: Groups & Budgets description: Organization groups, per-group budgets, and shared payment methods. - name: Organizations - Wallets x-group: Wallets description: Custodial stablecoin treasury wallets. - name: Organizations - Customers x-group: Customers description: The white-label customer CRM (Enterprise). - name: Organizations - Analytics x-group: Analytics description: Revenue, MRR, usage, conversion, and per-member metrics. - name: Organizations - Webhooks x-group: Webhooks description: Outbound webhook subscriptions and deliveries. - name: Organizations - Activity x-group: Activity description: The organization activity feed. - name: Organizations - Realtime x-group: Realtime description: Realtime WebSocket secret management (Enterprise). - name: Invitations x-group: Invitations description: Invite people to an organization. - name: Organizations - Integration x-group: Agent Discovery description: >- Public agent-discovery surfaces (llms.txt, agentic-instructions.md, ai-catalog.json). paths: /organizations/{orgId}/webhooks: post: tags: - Organizations - Webhooks summary: Create a webhook subscription description: >- Registers an outbound webhook endpoint for the organization. Every matching activity event is delivered as a signed HTTP POST to the target URL. The HMAC signing secret is generated server-side and returned ONCE in the response (in the `secret` field); it is never retrievable again, so store it immediately. Subsequent reads expose only a `secretHint` (last four characters). The URL is validated against an SSRF guard and must be https:// in production. Requires a Nevermined API key. Requires organization admin privileges. Requires the organization to be on the Premium tier or higher. operationId: WebhookSubscriptionsController_create parameters: - name: orgId required: true in: path description: Organization ID schema: type: string example: org-abc123 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateWebhookSubscriptionDto' responses: '201': description: >- Webhook subscription created. The response wraps the subscription and the plaintext signing `secret`, which is returned only this once. '401': description: Missing or invalid Nevermined API key '403': description: >- Caller is not an organization admin, or the org is not on the Premium tier or higher '422': description: Invalid webhook URL (bad scheme or private/reserved host) security: - Authorization: [] components: schemas: CreateWebhookSubscriptionDto: type: object properties: url: type: string description: >- Destination URL that receives the signed webhook POST. Must be an https:// URL in production (http:// is only accepted when the server explicitly allows it for development). The host must not resolve to a private, loopback, link-local, or cloud-metadata address (SSRF guard). example: https://example.com/hooks/nevermined maxLength: 2048 eventTypes: type: array description: >- Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types. example: - plan.purchased - customer.blocked items: $ref: '#/components/schemas/OrganizationActivityEventType' description: type: string description: Optional human-readable label shown in the dashboard. example: Billing notifications required: - url OrganizationActivityEventType: type: string enum: - member.invited - member.joined - member.role_changed - member.deactivated - member.reactivated - member.removed - invitation.revoked - invitation.expired - group.created - group.updated - group.deactivated - group.member_added - group.member_removed - group.budget_set - group.budget_threshold_reached - group.budget_exceeded - group.budget_reset - agent.created - plan.created - plan.updated - plan.purchased - customer.added - customer.blocked - customer.unblocked - subscription.upgraded - subscription.downgraded - subscription.canceled - subscription.lapsed - webhook.delivered - webhook.failed - apikey.created - apikey.revoked - credits.redeemed description: >- Event types this subscription should receive. Omit or pass an empty array to subscribe to all event types. securitySchemes: Authorization: scheme: bearer bearerFormat: JWT type: http ```` ## Related topics - [Update a webhook subscription](/docs/api-reference/organizations--webhooks/update-a-webhook-subscription.md) - [Get a webhook subscription](/docs/api-reference/organizations--webhooks/get-a-webhook-subscription.md) - [Delete a webhook subscription](/docs/api-reference/organizations--webhooks/delete-a-webhook-subscription.md) - [List webhook subscriptions](/docs/api-reference/organizations--webhooks/list-webhook-subscriptions.md) - [List deliveries for a webhook subscription](/docs/api-reference/organizations--webhooks/list-deliveries-for-a-webhook-subscription.md)