Skip to main content
POST

Authorizations

x-api-key
string
header
required

API key with sm_ prefix. Get your key at https://sudomock.com/dashboard/api-keys

Body

application/json

Create a webhook endpoint. URL SSRF-validation happens in the route (it needs DNS resolution and returns a clean 400); here we only enforce shape.

url
string
required

https endpoint URL

Required string length: 1 - 2048
description
string | null
Maximum string length: 255
event_types
enum<string>[]

Subscribed event types; empty = all events (wildcard).

Available options:
render.succeeded,
render.failed,
upload.succeeded,
video.succeeded,
video.failed,
2d_mockup.ready,
2d_mockup.rejected,
2d_mockup.failed,
2d_render.succeeded,
2d_render.failed,
photo_mockup.ready,
photo_mockup.rejected,
photo_mockup.failed,
photo_mockup_render.succeeded,
photo_mockup_render.failed,
webhook.test
event_naming
enum<string> | null

Which spelling of the photo-mockup events this endpoint receives: 'current' (photo_mockup., photo_mockup_render.) or 'legacy' (2d_mockup., 2d_render.). The payload's kind follows. Omit it and the endpoint is pinned to the spelling event_types is written in: the family names for a list that subscribes to them, otherwise 'legacy', the spelling this contract publishes.

Available options:
legacy,
current

Response

201 - application/json

Successful Response

Returned ONLY by create + rotate-secret: the FULL plaintext secret.

Overrides the masked secret field with the real value (shown once).

id
string
required
Example:

"b5cd6284-f6a0-4cfc-94df-781353e30dfd"

url
string
required
Example:

"https://your-app.example.com/hooks/sudomock"

secret
string
required

FULL signing secret. Shown only once.

Example:

"whsec_cb79146988c2f928cc0760c737c67368080948cdadf7a20c14311290682ee865"

enabled
boolean
required
Example:

true

created_at
string<date-time>
required
date-time
Example:

"2026-09-18T09:24:11.482713Z"

description
string | null
Example:

"Production render notifications"

event_types
string[]
Example:
event_naming
string
default:legacy

The event-name spelling this endpoint is pinned to: 'legacy' or 'current'.

updated_at
string<date-time> | null
date-time
Example:

"2026-09-18T09:31:02.117845Z"