# Create an endpoint

> Create a webhook endpoint. The signing secret is returned once.

`POST https://inboundr.net/api/v1/endpoints`

Creates a [webhook endpoint](/concepts/endpoints) — or a Slack/Discord
notification endpoint, see `type` below. For a webhook, the response includes
a `secret` (prefixed `whsec_`) shown **only once** — store it to
[verify signatures](/webhooks/verifying-signatures). Slack/Discord endpoints
have no secret.

<ParamField body="name" type="string" required>
  A label for the endpoint (1–100 chars).
</ParamField>
<ParamField body="type" type="string" default="webhook">
  `webhook`, `slack`, or `discord` (`forward` relays to a mailbox instead —
  see [forwarding](/concepts/endpoints#slack-and-discord)). Slack/Discord post
  a formatted notification to `url` (that channel's incoming-webhook URL)
  instead of raw JSON, and aren't signed.
</ParamField>
<ParamField body="url" type="string" required>
  Delivery URL (`http`/`https`). Must resolve to a public host — private and
  internal addresses are rejected. For `slack`/`discord`, must also match
  that provider's incoming-webhook host.
</ParamField>
<ParamField body="headers" type="object">
  Up to 10 custom headers sent with every delivery. Reserved headers
  (`Content-Type`, `X-Inboundr-*`, `X-Inbound-*`, …) can't be overridden.
</ParamField>
<ParamField body="timeoutSeconds" type="integer" default="10">
  Per-request timeout, 1–30 seconds.
</ParamField>
<ParamField body="maxAttempts" type="integer" default="5">
  Total attempts (first + retries), 1–10.
</ParamField>

<ResponseExample>
```json 201
{
  "id": "ep_123",
  "name": "Production handler",
  "url": "https://api.example.com/hooks/inbound",
  "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx",
  "headers": { "X-Team": "growth" },
  "timeoutSeconds": 10,
  "maxAttempts": 5,
  "active": true,
  "createdAt": "2026-07-20T10:00:00.000Z"
}
```
</ResponseExample>

<Warning>Copy the `secret` now — it's shown only at creation.</Warning>