> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Register a webhook endpoint > Register a webhook endpoint to receive event notifications. URL must be HTTPS and not target a private/loopback/link-local/CGNAT host (SSRF defense). Optional `secret` is used to compute the X-Orbit-Signature HMAC (canonical header); X-Devotel-Signature carries an identical back-compat copy. If omitted, Orbit auto-generates one and returns it in the response (this is the only time the secret is returned in cleartext — it is encrypted at rest after). See [Webhook Security](/webhooks/security) for verification instructions. ## OpenAPI ````yaml /openapi.yaml post /api/v1/webhooks/ openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway paths: /api/v1/webhooks/: post: tags: - Webhooks summary: Register a webhook endpoint description: >- Register a webhook endpoint to receive event notifications. URL must be HTTPS and not target a private/loopback/link-local/CGNAT host (SSRF defense). Optional `secret` is used to compute the X-Orbit-Signature HMAC (canonical header); X-Devotel-Signature carries an identical back-compat copy. If omitted, Orbit auto-generates one and returns it in the response (this is the only time the secret is returned in cleartext — it is encrypted at rest after). See [Webhook Security](/webhooks/security) for verification instructions. requestBody: required: true content: application/json: schema: type: object required: - url - events properties: url: type: string format: uri description: HTTPS endpoint URL. examples: - https://yourapp.com/webhooks/orbit events: type: array minItems: 1 items: type: string description: >- Subscribed event types. See WEBHOOK_EVENT_TYPES (e.g. `message.delivered`, `call.completed`, `verification.approved`). examples: - - message.delivered - message.failed - call.completed secret: type: string minLength: 16 description: >- Optional shared secret. Used to verify the X-Orbit-Signature HMAC (canonical header) on every delivery. X-Devotel-Signature carries the identical value for back-compat. Prefer X-Orbit-Signature in verifier code. active: type: boolean default: true description: Whether to start dispatching events immediately. description: type: string maxLength: 255 timeout_seconds: type: integer minimum: 1 maximum: 30 default: 30 description: >- Per-endpoint HTTP delivery timeout in seconds (1-30). The dispatcher aborts an in-flight delivery once this many seconds elapse. Defaults to 30 (the platform hard ceiling) when omitted. retry_policy: type: object properties: max_retries: type: integer minimum: 0 maximum: 10 backoff_strategy: type: string enum: - fixed - exponential initial_delay_ms: type: integer minimum: 100 maximum: 86400000 responses: '201': description: Endpoint registered content: application/json: schema: type: object description: Endpoint registered properties: data: type: object additionalProperties: true properties: id: type: string url: type: string format: uri events: type: array items: type: string active: type: boolean description: type: - 'null' - string timeout_seconds: type: integer minimum: 1 maximum: 30 secret: type: - 'null' - string description: >- The plaintext signing secret — returned on creation (whether caller-supplied or auto-generated) and on secret rotation. Subsequent GET requests return a masked preview only. created_at: type: string format: date-time updated_at: type: - 'null' - string format: date-time meta: type: object properties: request_id: type: string description: >- Unique request identifier (also returned in X-Request-Id header) timestamp: type: string format: date-time description: ISO 8601 UTC timestamp of the response '422': description: Default Response content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: >- Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````