POST

Create a webhook endpoint

https://www.helprange.com/api/v2/webhook-endpoints

Sets the team's webhook URL (as Settings → Integrations → Webhook) and answers with the signing secret – shown once. Every event is sent to it. 409 endpoint_exists when the team already has one (change its url instead). Scope webhooks:manage; team administrators only (403 otherwise); live keys only – test keys get 400 livemode_required (the sandbox sends no webhooks).

Plans: Pro, Max, Unlimited, Deal Room Pass, trial. Auth: Authorization: Bearer hr_live_… (team key), X-API-Key, Authorization: Api-Key <key> or an OAuth Bearer token. Scope: webhooks:manage. Operation id: createWebhookEndpoint

Header Idempotency-Key (optional, up to 255 characters): retry with the same key and body within 24 hours and you get the first response back (Idempotent-Replayed: true) – the request is not run twice. Another body: 422 idempotency_key_reused; still running: 409 idempotency_key_in_progress. More.

Request body

Content types: application/json, application/x-www-form-urlencoded.

FieldTypeDescription
url requiredstring (uri)https only, a public internet address (localhost, private networks and cloud metadata addresses are refused: 400 url_not_public). (max length 500)

Example request

curl -X POST https://www.helprange.com/api/v2/webhook-endpoints \
  -H "X-API-Key: $HELPRANGE_API_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary '{"url": "https://hooks.example.com/helprange"}'

The samples read the key from the HELPRANGE_API_KEY environment variable.

Responses

StatusDescription
201Created
400Invalid input – the message says which parameter.
401Missing or invalid API key / OAuth token. Team keys: code invalid_key, key_revoked, key_expired or key_owner_removed.
402Your plan does not include the REST API (the Free plan) or this feature (e.g. NDA needs Max).
403The team API key lacks the scope this endpoint needs.
405Wrong HTTP method for this endpoint.
409The data room is frozen, the signed PDF is not ready yet, (webhooks) the team already has an endpoint / the endpoint is turned off, or (code idempotency_key_in_progress) a request with the same Idempotency-Key is still running – retry in a few seconds.
422code idempotency_key_reused: this Idempotency-Key was already used in the last 24 hours with a different request (method, path or body). Use a new key for a new request.
429A usage limit was reached – wait Retry-After seconds.
Example response · 201
{
  "id": 3,
  "url": "https://hooks.example.com/helprange",
  "enabled": true,
  "disabled_reason": null,
  "disabled_at": null,
  "consecutive_failures": 0,
  "last_success_at": null,
  "secret_rotated_at": null,
  "previous_secret_expires_at": null,
  "created_at": "2026-11-15T09:00:00+00:00",
  "events": [
    "document.acknowledged",
    "document.opened",
    "file_request.uploaded",
    "nda.accepted",
    "offer.accepted",
    "offer.contact_requested",
    "offer.declined",
    "room.access_requested"
  ],
  "secret": "whsec_q8Wm3…"
}

Try it

Uses your real account. The request goes from your browser straight to www.helprange.com with your API key and acts as you – this POST changes data. The key stays in this page (in this tab's session storage only if you tick the box), is never put in a URL and is not sent to analytics. Do not paste a key on a shared computer.