> ## Documentation Index > Fetch the complete documentation index at: https://docs.infinityapp.in/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook endpoint > Up to 5 endpoints per account. The response holds the signing `secret`; **this is the only time it's shown**, so store it now. There's no secret rotation in v1: to replace a secret, create a new endpoint and delete the old one. ## OpenAPI ````yaml /api-reference/openapi.yaml post /webhook-endpoints openapi: 3.1.0 info: title: Infinity API version: v1 description: > Send cross-border payouts from your USD balance to payees' bank accounts. - **Hosts:** `https://sandbox-api.infinityapp.in/v1` for testing and `https://api.infinityapp.in/v1` for live money. - **Auth:** `Authorization: Bearer sk_test_…` on the sandbox, `sk_live_…` on live. - **JSON:** field names are snake_case. Amounts are decimal strings (`"500.00"`), currency codes are lowercase ISO 4217 (`"eur"`), countries are uppercase ISO 3166 alpha-2 (`"NL"`), and timestamps are ISO 8601 in UTC. - **Fixed shapes:** every documented response field is always present. It's `null` when there's no value, and `metadata` is `{}` when empty. - **Strict input:** an unknown field or query parameter gets a `400 unknown_parameter`, and a number where a string is expected gets a `400 type_mismatch`. - **Lists:** `limit` (1–100, default 20) and `starting_after` (the last id you saw). Responses are `{ "data": [...], "has_more": true }`, newest first. - **Idempotency:** the `Idempotency-Key` header is required on money-moving creates and optional on the others. The same key with the same body within 24 hours returns the original response. - **Request ID:** every response has a `Request-Id` header. Quote it to support. - **Rate limits:** 20 requests per second per key, with bursts up to 40. Over that gets a `429` with `Retry-After`. - **Versioning:** `/v1` only grows. New fields, endpoints, enum values, event types and error codes can be added at any time, so ignore what you don't recognise. servers: - url: https://sandbox-api.infinityapp.in/v1 description: Sandbox (sk_test_ keys) - url: https://api.infinityapp.in/v1 description: Live (sk_live_ keys) security: - apiKey: [] tags: - name: Account description: Your account profile and settings. - name: Wallets description: >- Funds held for you, one wallet per currency. Every payout names the wallet that pays for it. - name: Funding addresses description: Bank details you send money to, to fund your balance. - name: Deposits description: Money credited to your balance. - name: Currencies description: The currencies we support and which ones you can pay out in. - name: Exchange rates description: Indicative rates. A quote is the price. - name: Payees description: The people and businesses you pay. - name: Payee addresses description: >- A payee's bank account, sent by you instead of the payee filling in our hosted form. - name: Bank requirements description: The fields each currency and rail needs. - name: Quotes description: Price payouts before you send them. Nothing is saved. - name: Payouts description: Create 1 to 100 payouts in one call, then track, update or cancel them. - name: Batches description: The set of payouts created by one Create payouts call. - name: Webhook endpoints description: URLs we notify when something changes. - name: Events description: Every change from the last 30 days, to catch up on missed webhooks. paths: /webhook-endpoints: post: tags: - Webhook endpoints summary: Create a webhook endpoint description: > Up to 5 endpoints per account. The response holds the signing `secret`; **this is the only time it's shown**, so store it now. There's no secret rotation in v1: to replace a secret, create a new endpoint and delete the old one. operationId: createWebhookEndpoint parameters: - $ref: '#/components/parameters/IdempotencyKeyOptional' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateWebhookEndpointRequest' responses: '200': description: The new endpoint, with its `secret`. content: application/json: schema: $ref: '#/components/schemas/WebhookEndpoint' '400': description: > - `invalid_webhook_endpoint_request`: a bad `url` (not https, a private address, too long), an unknown event type, or `*` mixed with other types. - `webhook_endpoint_limit_reached`: the account already has 5 endpoints. - `missing_parameter`, `unknown_parameter`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': description: >- `webhook_endpoint_exists`: another endpoint already uses this `url`. `idempotency_key_reused`, `idempotency_key_in_use`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': $ref: '#/components/responses/RateLimited' 5XX: $ref: '#/components/responses/ServerError' components: parameters: IdempotencyKeyOptional: name: Idempotency-Key in: header required: false description: Optional. Makes a retry safe, as on money-moving creates. schema: type: string maxLength: 255 schemas: CreateWebhookEndpointRequest: type: object additionalProperties: false required: - url - events properties: url: type: string maxLength: 2048 description: >- `https://` only, on a public host (no IP address, no private or internal name). Not already used by another of your endpoints. example: https://acme.com/webhooks/infinity events: type: array minItems: 1 maxItems: 24 uniqueItems: true items: type: string description: Event types, or exactly `["*"]` for every type. example: - payout.paid - payout.failed description: type: string maxLength: 500 example: Production payouts WebhookEndpoint: type: object required: - id - url - events - status - description - secret - created_at - updated_at properties: id: type: string example: webhook_qjvv94gq6e73azsa url: type: string example: https://acme.com/webhooks/infinity events: type: array items: type: string description: Event types, or `["*"]` for every type, including ones added later. example: - payout.paid - payout.failed status: type: string enum: - enabled - disabled description: type: - string - 'null' example: Production payouts secret: type: - string - 'null' description: >- `whsec_…`, for checking signatures. Only in the create response; `null` everywhere else. example: whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw created_at: type: string format: date-time example: '2026-10-26T10:00:00Z' updated_at: type: string format: date-time example: '2026-10-26T10:00:00Z' ErrorResponse: type: object required: - error properties: error: type: object required: - type - code - message - param - request_id - timestamp properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - rate_limit_error - api_error description: The class of error, from the HTTP status. code: type: string description: >- What went wrong. Branch on this. New codes can be added, so handle an unknown one by its HTTP status. example: invalid_payout_request message: type: string description: For a developer to read. It can change, so never parse it. example: amount has more than 2 decimals for eur. param: type: - string - 'null' description: >- The field at fault, with its path: `amount`, `items[3].payee_id`, `beneficiary_address.postal_code` or `Idempotency-Key`. example: amount request_id: type: string description: The same as the `Request-Id` header. example: req_4f4b2bjc4mamxuxm timestamp: type: string format: date-time example: '2026-10-29T10:00:00Z' responses: Unauthorized: description: >- `missing_authorization`, `invalid_api_key` (no such key, or it's revoked), `wrong_environment` (a test key on live, or a live key on the sandbox). headers: Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: type: authentication_error code: wrong_environment message: This is a live key. Use it on api.infinityapp.in. param: null request_id: req_4f4b2bjc4mamxuxm timestamp: '2026-10-29T10:00:00Z' Forbidden: description: '`account_inactive`: the account behind this key isn''t active.' headers: Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' RateLimited: description: >- `rate_limited`: over 20 requests per second for this key. Wait for `Retry-After` and try again. headers: Retry-After: $ref: '#/components/headers/RetryAfter' Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServerError: description: >- `internal_server_error` (500, our fault) or `service_unavailable` (503, something we depend on is down). Safe to retry with the same `Idempotency-Key`. headers: Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' headers: RequestId: description: This call's id. Quote it to support. schema: type: string example: req_4f4b2bjc4mamxuxm RetryAfter: description: Seconds to wait before retrying. schema: type: integer example: 1 securitySchemes: apiKey: type: http scheme: bearer description: > Your secret key: `sk_test_…` on the sandbox host, `sk_live_…` on live. A key on the wrong host gets a `401 wrong_environment`. Keys are secret. Keep them on your server, never in a browser or app. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.