> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create an endpoint > Registers an HTTPS URL to receive events for your organisation, or with `scope=customer` for every organisation on your account, including ones added later, which needs account-wide access. The response carries the endpoint's signing secret, shown only this once: store it to verify every delivery's `v1` signature. It also carries the endpoint's public key, which verifies the `v1a` signature instead and can be read again at any time. Send an `Idempotency-Key` header to make a retried request safe. ## OpenAPI ````yaml /api-reference/specs/webhooks.json post /endpoints openapi: 3.1.1 info: title: Webhooks Service description: >- Outbound webhooks for FlowPayroll: register an endpoint, subscribe to event types, manage signing secrets, inspect the delivery log and replay. version: v1 servers: - url: https://api.sandbox.flowpayroll.ai/v1/webhooks security: - X-Auth-Token: [] tags: - name: Alert contacts - name: Delivery log - name: Endpoint subscriptions - name: Endpoints - name: Event types - name: Events - name: Replays paths: /endpoints: post: tags: - Endpoints summary: Create an endpoint description: >- Registers an HTTPS URL to receive events for your organisation, or with `scope=customer` for every organisation on your account, including ones added later, which needs account-wide access. The response carries the endpoint's signing secret, shown only this once: store it to verify every delivery's `v1` signature. It also carries the endpoint's public key, which verifies the `v1a` signature instead and can be read again at any time. Send an `Idempotency-Key` header to make a retried request safe. operationId: CreateEndpoint parameters: - name: scope in: query description: >- Whose resources: your organisation's (the default), or with account-wide access the account's (`customer`). schema: enum: - organisation - customer type: string default: organisation - name: Idempotency-Key in: header description: >- Makes a retry safe: the same key from the same person with the same body within 24 hours gets the first response back instead of running again. The same key with a different request is refused with 409. schema: maxLength: 255 type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateEndpointRequest' required: true responses: '201': description: Created headers: Location: description: Where the new resource can be read. schema: type: string format: uri content: application/json: schema: $ref: '#/components/schemas/CreatedEndpointResponseResponseBody' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/ObjectResponseBody' components: schemas: CreateEndpointRequest: required: - eventTypes - url type: object properties: url: type: string description: type: - 'null' - string eventTypes: type: array items: type: string payloadStyle: enum: - Minimal - Full - null type: - 'null' - string ordering: enum: - Unordered - Fifo - null type: - 'null' - string rateLimitPerSecond: type: - 'null' - integer format: int32 organisationIds: type: - 'null' - array items: type: string excludedOrganisationIds: type: - 'null' - array items: type: string customHeaders: type: - 'null' - object additionalProperties: type: string alertContacts: type: - 'null' - array items: type: string additionalProperties: false CreatedEndpointResponseResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/CreatedEndpointResponseContentResponse' validationIssues: type: - 'null' - array items: $ref: '#/components/schemas/ValidationIssue' additionalProperties: false ObjectResponseBody: type: object properties: message: $ref: '#/components/schemas/MessageWithTokenResponse' content: $ref: '#/components/schemas/ObjectContentResponse' validationIssues: type: - 'null' - array items: $ref: '#/components/schemas/ValidationIssue' additionalProperties: false MessageWithTokenResponse: type: object properties: text: type: string token: type: string tokenArguments: type: - 'null' - array items: $ref: '#/components/schemas/ValidationIssueArgument' additionalProperties: false CreatedEndpointResponseContentResponse: type: object properties: data: $ref: '#/components/schemas/CreatedEndpointResponse' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssue: type: object properties: field: type: string reason: type: string reasonToken: type: string reasonTokenArguments: type: - 'null' - array items: $ref: '#/components/schemas/ValidationIssueArgument' additionalProperties: false ObjectContentResponse: type: object properties: data: type: 'null' metadata: $ref: '#/components/schemas/ContentMetadataResponse' additionalProperties: false ValidationIssueArgument: type: object properties: name: type: string value: type: 'null' additionalProperties: false CreatedEndpointResponse: type: object properties: endpoint: $ref: '#/components/schemas/EndpointResponse' signingSecret: type: string publicKey: type: string additionalProperties: false ContentMetadataResponse: type: object properties: dateFormat: type: string dateTimeFormat: type: string paginationToken: type: - 'null' - string description: >- Cursor for the next page, present only when more results follow and null on the last page. Pass it back unmodified to continue; it is opaque and short-lived, so do not store it. additionalProperties: false EndpointResponse: required: - alertContacts - apiVersion - createdDate - customHeaderNames - destinationType - endpointId - eventTypes - excludedOrganisationIds - ordering - organisationIds - ownerId - payloadStyle - scope - status - updatedDate - url type: object properties: endpointId: type: string scope: enum: - Organisation - Customer type: string ownerId: type: string url: type: string description: type: - 'null' - string status: enum: - Paused - Active - DisabledBySystem type: string statusReason: type: - 'null' - string destinationType: enum: - Https type: string apiVersion: type: string payloadStyle: enum: - Minimal - Full type: string ordering: enum: - Unordered - Fifo type: string rateLimitPerSecond: type: - 'null' - integer format: int32 eventTypes: type: array items: type: string organisationIds: type: array items: type: string excludedOrganisationIds: type: array items: type: string customHeaderNames: type: array items: type: string alertContacts: type: array items: type: string createdDate: type: string updatedDate: type: string additionalProperties: false securitySchemes: X-Auth-Token: type: apiKey description: FlowPayroll JWT (raw token, no Bearer prefix) name: X-Auth-Token in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.