post_v1_webhooks
Registers a new webhook subscription for the caller's org and answers 201 with the endpoint INCLUDING its freshly minted signing secret.
Registers a new webhook subscription for the caller's org and answers 201 with the endpoint INCLUDING its freshly minted signing secret. This is one of only two responses that ever carry that secret (the other is rotate) — store it now, because no later read returns it. The org is stamped by the server from the validated principal, so a body can never register an endpoint in another tenant.
| Tool | post_v1_webhooks |
| Door | https://api.hanzo.ai/v1/mcp |
| Method | tools/call (JSON-RPC 2.0) |
| Arguments | 4 |
| Operation | POST /v1/webhooks |
| Product | webhooks |
Arguments
| Field | Type | Required | Default | Values | Description |
|---|---|---|---|---|---|
description | string | — | — | — | Description is a free-text label for the console. Optional, clipped to 1024 bytes. |
events | string[] | — | — | — | Events are NATS subject patterns to subscribe to (e.g. "commerce.order.>"). An empty or omitted list means EVERY event on the platform bus. Max 64 patterns, each max 256 bytes. |
status | string | — | — | — | Status is "active" or "disabled". Empty defaults to active. A disabled endpoint receives no bus deliveries, but can still be exercised with POST /v1/webhooks/{id}/test. |
url | string | — | — | — | URL is the https:// address each matching event is POSTed to. Required, max 2048 bytes; http:// and every other scheme is refused, because a webhook carries signed event data and must not travel in the clear. |
tools/list declares a type and a description for each field and nothing further. A — means neither the door nor that operation constrains the field.
Call it
A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Nothing above is required, so every declared argument is shown rather than a guess at which matter.
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "post_v1_webhooks",
"arguments": {
"description": "<description>",
"events": [
"<events>"
],
"status": "<status>",
"url": "<url>"
}
}
}'Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →
The operation behind it
| Operation | Route | Product | Summary |
|---|---|---|---|
post_v1_webhooks | POST /v1/webhooks | webhooks | Registers a new webhook subscription for the caller's org and answers 201 with the… |
The same capability over plain HTTP is in the webhooks API reference, on https://api.hanzo.ai.
All 755 tools · The door · API reference
Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01, of which 755 are documented here (the operator surface is not published) (this build read the vendored copy; the door was unreachable).
How is this guide?
get_v1_webhooks_id_deliveries
Returns one endpoint's per-attempt delivery log, newest first — the record of what was sent, what the subscriber answered, and how long it took.
post_v1_webhooks_id_secret
Mints a NEW HMAC signing secret for the endpoint and answers the endpoint WITH it — the only other response besides create that ever carries a secret.