> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gobare.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a webhook

> Subscribe an endpoint to session events.



## OpenAPI

````yaml /openapi.json post /v1/webhooks
openapi: 3.1.0
info:
  title: Gobare Agent API
  version: v1
  description: >-
    Programmatic access to Gobare coding-agent sessions. Conceptually aligned
    with OpenAI's Agents API; deliberately not wire-compatible with it. See the
    divergence list in the product documentation.
servers:
  - url: https://api.{domain}
    variables:
      domain:
        default: gobare.dev
security: []
paths:
  /v1/webhooks:
    post:
      summary: Create a webhook
      description: Subscribe an endpoint to session events.
      operationId: post_webhooks
      parameters:
        - name: Idempotency-Key
          in: header
          required: false
          schema:
            type: string
            maxLength: 255
          description: >-
            Retrying with the same key replays the first answer instead of
            acting again.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookCreateRequest'
      responses:
        '201':
          description: Subscribe an endpoint to session events.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookSubscriptionCreated'
        '400':
          description: >-
            `invalid_request`. A field this endpoint does not read, a field of
            the wrong shape, a query parameter it does not take, or a body past
            the size ceiling. Refused rather than ignored: a setting you believe
            you made is one we really made.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: The access token is missing, unrecognised, expired or revoked.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            The token is valid but may not perform this call. The message names
            the scope it wanted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: >-
            No such endpoint, or the public API is not enabled on this
            deployment.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: >-
            The session's state does not allow this call, or an identical
            request is already in flight under the same Idempotency-Key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            `rate_limit_exceeded` — the token is past its allowance for this
            bucket; honour `Retry-After`. Or `queue_full` — too many messages
            are already waiting behind the current turn. Branch on `code`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: An unexpected error. Quote the request id.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - accessToken: []
components:
  schemas:
    WebhookCreateRequest:
      type: object
      example:
        url: https://you.example.com/hooks/gobare
        events:
          - turn.completed
          - turn.failed
      required:
        - url
      properties:
        url:
          type: string
          description: https only.
        events:
          type: array
          items:
            type: string
          description: Empty or absent means every event.
    WebhookSubscriptionCreated:
      type: object
      required:
        - object
        - id
        - url
        - events
        - secret
      description: >-
        The secret appears in this response only. Store it; it cannot be shown
        again.
      properties:
        object:
          type: string
          const: webhook.subscription
          description: >-
            Always `webhook.subscription`. Names the shape, so a value can be
            identified without knowing which call returned it.
        id:
          type: string
          description: Ours. Use it to delete the subscription.
        url:
          type: string
          description: Where deliveries go. Must be https.
        events:
          type: array
          description: Which events to deliver. An empty list means all of them.
          items:
            type: string
        active:
          type: boolean
          description: >-
            False once deliveries have been given up on. See webhooks.md on
            retries and dead letters.
        secret:
          type: string
          description: >-
            Recompute x-gobare-signature as HMAC-SHA256 over
            `<timestamp>.<body>`.
    Error:
      type: object
      required:
        - error
      description: Every refusal this API makes, in one shape.
      properties:
        error:
          description: Always present on a failure, and the only thing present.
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              enum:
                - invalid_request
                - authentication_error
                - permission_denied
                - not_found
                - method_not_allowed
                - conflict
                - queue_full
                - rate_limit_exceeded
                - project_limit_exceeded
                - context_length_exceeded
                - provider_error
                - provider_unauthorized
                - sandbox_error
                - sandbox_unavailable
                - directory_unavailable
                - workspace_recovery_failed
                - bridge_incompatible
                - internal_error
            message:
              type: string
            request_id:
              type: string
              description: >-
                Also on the x-request-id header. Quote it when reporting a
                problem.
  securitySchemes:
    accessToken:
      type: http
      scheme: bearer
      description: >-
        A `gbr_pat_` access token. Scopes are recorded on the token when it is
        minted.

````