When it fires
After CreateWebhookService succeeds. Neither the secret value nor the endpoint URL is in the payload, only secretLastFour for identification. Receiver URLs often carry a token of their own, so they are never fanned out to other endpoints.
Payload
ts
{
type: 'webhook.created',
data: {
webhook: {
id: string
name: string
description: string | null
eventTypes: Array<string>
enabled: boolean
secretLastFour: string
createdAt: string
}
}
}Example
json
{
"type": "webhook.created",
"data": {
"webhook": {
"id": "0192a1b2-c3d4-7000-8000-0000000000d0",
"name": "PagerDuty bridge",
"description": "Page on-call when a key is deleted",
"eventTypes": ["key.deleted", "webhook.delivery_failed"],
"enabled": true,
"secretLastFour": "x9k2",
"createdAt": "2026-05-31T13:00:00.000Z"
}
}
}