Register a webhook endpoint
Register an HTTPS endpoint to receive signed event deliveries. The signing secret is returned once in this response.
Authorization
BearerAuth Medblocks API key for server-side requests.
In: header
Header Parameters
Date-pinned API version. If omitted, Medblocks uses the version pinned on your API key.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/webhooks" \ -H "Version: 2026-04-25" \ -H "Content-Type: application/json" \ -d '{ "url": "https://api.fhirapp.com/medblocks/webhook", "events": [ "patient_session.completed", "records.sync.completed" ], "description": "Production webhook", "metadata": {} }'{ "id": "wh_01J9YR9N3X4VZ6P2K5RH7M3LMP", "resource_type": "webhook_endpoint", "url": "https://api.fhirapp.com/medblocks/webhook", "events": [ "patient_session.completed", "connection.token_refresh_failed" ], "status": "active", "description": "Production webhook", "metadata": {}, "api_version": "2026-04-25", "created_at": "2026-04-25T14:30:00.000Z", "updated_at": "2026-04-25T14:30:00.000Z", "secret": "whsec_01J9YR9N3X4VZ6P2K5RH7M3LMPabcdef0123456789abcdef0123456789"}{ "error": { "type": "authentication_error", "code": "invalid_api_key", "message": "API key invalid", "param": null, "doc_url": "https://docs.medblocks.com/errors/invalid_api_key", "request_id": "9c9b6f7a-8e4f-4a3b-9c1e-6f3a2d8b7c4d" }}error.code and error.request_id for support.Your HTTPS endpoint that receives event deliveries. http://localhost is allowed for local dev only.
uriEvent-type filter. Either ["*"] (deliver all events) or an explicit list of event types. Unknown types are rejected.
1 <= items <= 5Human-readable label, visible in the dashboard.
length <= 500Up to 50 keys of arbitrary developer metadata. Echoed back on every read.
List webhook endpoints GET
List your organization's webhook endpoints with cursor pagination and an optional status filter. Secrets are never returned.
Retrieve a webhook endpoint GET
Retrieve a single webhook endpoint by its wh_ id, including its URL, subscribed events, and status. The secret is never returned.