> ## Documentation Index > Fetch the complete documentation index at: https://docs.hypermid.io/llms.txt > Use this file to discover all available pages before exploring further. # Register a webhook endpoint > Subscribes a URL to one or more completion events. The signing `secret` is returned ONLY in this response and is not re-readable afterwards — store it before discarding the response, or rotate to obtain a new one. The URL must resolve to a publicly routable address; it is re-checked at delivery time, not only here. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/payments/webhooks openapi: 3.1.0 info: title: Hypermid API description: >- Price and execute cross-chain swaps, read reference data and payer balances, and quote the fiat on-ramp. Quotes return an executable `transactionRequest` your frontend submits directly, so Hypermid never custodies the funds. Payments — `checkout`, `deposit`, and `withdrawal` sessions — and payment-link management are available through these merchant REST endpoints and the [`@hypermid/sdk`](https://docs.hypermid.io/sdk/payments) package. Payer-facing routes are intentionally omitted. version: 0.2.0 contact: {} servers: - url: https://server.hypermid.io description: Production — live keys (sk_live_…) - url: https://server.hypermid.io description: Sandbox — test keys (sk_test_…), testnets only security: [] tags: - name: payments description: >- Create and read payment sessions, manage webhooks, and configure payout addresses with a secret partner key. - name: payment links description: >- Create, read, version, and revoke reusable checkout payment links with a secret partner key. - name: quote description: >- Route pricing for the orchestration product. Returns an executable `transactionRequest` your frontend submits directly, so Hypermid never custodies the funds. - name: status description: >- Resolve the state of a submitted swap or transfer. Two endpoints with different audiences — see each one's description before choosing. - name: catalog description: >- Reference data an integration needs to render a picker: supported chains and tokens, prices, routable connections, and fee configuration. A sandbox key sees only testnets here. - name: balances description: Read a payer wallet's token balances across supported chains. - name: onramp description: >- The fiat rail — card and bank payment for crypto, quoted and settled through our onramp partner. Requires per-partner onramp credentials on your account. - name: webhooks description: >- Events Hypermid sends TO you when a session completes. These are requests we make to your server, not endpoints you call. paths: /v1/payments/webhooks: post: tags: - payments summary: Register a webhook endpoint description: >- Subscribes a URL to one or more completion events. The signing `secret` is returned ONLY in this response and is not re-readable afterwards — store it before discarding the response, or rotate to obtain a new one. The URL must resolve to a publicly routable address; it is re-checked at delivery time, not only here. operationId: PaymentController_addWebhook parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateCheckoutWebhookDto' responses: '201': description: Webhook registered; the signing secret is returned only here. content: application/json: schema: allOf: - $ref: '#/components/schemas/ApiEnvelope' - type: object required: - data properties: data: $ref: '#/components/schemas/WebhookEndpointDto' '400': description: Invalid request (`BAD_REQUEST` or `INVALID_PARAMS`). content: application/json: schema: $ref: '#/components/schemas/PaymentErrorResponseDto' '401': description: Missing, invalid, or non-secret partner key (`UNAUTHORIZED`). content: application/json: schema: $ref: '#/components/schemas/PaymentErrorResponseDto' '403': description: >- Key or operation forbidden (`FORBIDDEN` or `RECIPIENT_NOT_ALLOWLISTED`). content: application/json: schema: $ref: '#/components/schemas/PaymentErrorResponseDto' '500': description: Unexpected server error (`INTERNAL_ERROR`). content: application/json: schema: $ref: '#/components/schemas/PaymentErrorResponseDto' security: - bearer: [] components: schemas: CreateCheckoutWebhookDto: type: object properties: url: type: string example: https://merchant.example/hypermid/webhook description: HTTPS endpoint that receives delivery attempts. events: example: - checkout.completed - deposit.completed - withdrawal.completed description: Events to subscribe to. Omit to receive all three. type: array items: type: string required: - url ApiEnvelope: type: object properties: traceId: type: string description: W3C trace id of the request — correlate with logs/traces in SigNoz. example: 4bf92f3577b34da6a3ce929d0e0e4736 code: type: string enum: - OK - BAD_REQUEST - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - RATE_LIMITED - PAYLOAD_TOO_LARGE - UNSUPPORTED_CHAIN - INTERNAL_ERROR - UPSTREAM_TIMEOUT - UPSTREAM_ERROR - SERVICE_UNAVAILABLE - KILL_SWITCH_ACTIVE - CIRCUIT_BREAKER_OPEN - NO_QUOTE_AVAILABLE - QUOTE_STALE - SIMULATION_REVERTED - INVALID_PARAMS - AMOUNT_OUT_OF_BOUNDS - PAYOUT_TOKEN_NOT_ALLOWED - RECIPIENT_NOT_ALLOWLISTED - PAYMENT_EXPIRED - PAYMENT_NOT_FOUND - NOT_CONFIGURED - INSUFFICIENT_LIQUIDITY - ROUTE_TEMPORARILY_UNAVAILABLE - UNSUPPORTED_ROUTE - OVER_DELIVERY_CAP description: >- Domain error code. `OK` on success; non-OK values come with a non-null `error`. example: OK error: type: - string - 'null' description: Human-readable error message. `null` on success. example: null data: type: - object - 'null' description: Endpoint-specific payload. `null` on error. required: - traceId - code - error - data WebhookEndpointDto: type: object properties: id: type: string description: Endpoint id, used to rotate, test or delete it. url: type: - string - 'null' description: >- Destination URL. Must be publicly routable; re-checked at delivery time. events: description: >- Events this endpoint receives. Anything not listed is not delivered here. type: array items: type: string secret: type: - string - 'null' description: >- HMAC signing secret. Returned ONLY when the endpoint is created or rotated — it is not readable from the list. Store it before discarding this response. secretPrevious: type: - string - 'null' description: Previous secret, still accepted during the rotation overlap window. secretPreviousExpiresAt: type: - string - 'null' format: date-time description: When the previous secret stops being accepted. status: type: string description: >- `active` or `disabled`. A disabled endpoint is skipped without error. createdAt: type: string format: date-time description: When the endpoint was registered. required: - url - events - secret - secretPrevious - secretPreviousExpiresAt - status PaymentErrorResponseDto: type: object properties: traceId: type: string example: 4bf92f3577b34da6a3ce929d0e0e4736 description: >- Correlation id for this request. Quote it in any support message — it is how we find your call in our logs. code: type: string enum: - OK - BAD_REQUEST - UNAUTHORIZED - FORBIDDEN - NOT_FOUND - CONFLICT - RATE_LIMITED - PAYLOAD_TOO_LARGE - UNSUPPORTED_CHAIN - INTERNAL_ERROR - UPSTREAM_TIMEOUT - UPSTREAM_ERROR - SERVICE_UNAVAILABLE - KILL_SWITCH_ACTIVE - CIRCUIT_BREAKER_OPEN - NO_QUOTE_AVAILABLE - QUOTE_STALE - SIMULATION_REVERTED - INVALID_PARAMS - AMOUNT_OUT_OF_BOUNDS - PAYOUT_TOKEN_NOT_ALLOWED - RECIPIENT_NOT_ALLOWLISTED - PAYMENT_EXPIRED - PAYMENT_NOT_FOUND - NOT_CONFIGURED - INSUFFICIENT_LIQUIDITY - ROUTE_TEMPORARILY_UNAVAILABLE - UNSUPPORTED_ROUTE - OVER_DELIVERY_CAP example: INVALID_PARAMS description: >- Stable machine-readable error code. Branch on this, not on `error`, whose wording may change. error: type: string example: orderId is required description: >- Human-readable explanation. For logs and developers — not intended to be shown to a payer verbatim. data: type: - object - 'null' example: null description: >- Always null on an error. Present so success and error envelopes have the same shape. required: - traceId - code - error - data securitySchemes: bearer: scheme: bearer bearerFormat: API key type: http description: >- Secret partner API key (`sk_live_…` or `sk_test_…`). Required to create or manage payment sessions. Server-side only — it can move money, so it must never reach a browser bundle. The key's prefix also selects the environment: `sk_test_` is confined to testnets. ````