> ## Documentation Index
> Fetch the complete documentation index at: https://docs.glasswarp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a session webhook

> Register a public HTTPS endpoint. Management uses the **console JWT**
(same as `/v1/keys`) — API keys (`gw_*`) cannot create webhooks.

The response includes `webhook.secret` once — verify deliveries with
`X-Glasswarp-Signature` over `"{timestamp}.{body}"` and
`X-Glasswarp-Timestamp` (reject skew > 5 minutes).

URLs are DNS-resolved at create and again at every delivery; private /
loopback / link-local / cloud-metadata addresses are rejected. Redirects
are not followed. Max 5 webhooks per account.




## OpenAPI

````yaml /openapi.yaml post /v1/webhooks
openapi: 3.1.0
info:
  title: Glasswarp Platform API
  version: 1.0.0
  description: >
    Real-time visual access and native input control on Windows machines.

    See any screen. Control any PC. One API.


    ## Authentication


    Most `/v1/*` endpoints require a bearer token:


    ```

    Authorization: Bearer gw_live_sk_...

    ```


    Exception: `GET /v1/agent/latest` is public (host auto-update).


    API keys are created in the [Console](/console/keys).

    Keys are scoped to your account and can access any rig with API access
    enabled.


    ## Base URL


    `https://signal.glasswarp.com`
  contact:
    name: Glasswarp
    url: https://glasswarp.com
  license:
    name: Proprietary
servers:
  - url: https://signal.glasswarp.com
    description: Production
security:
  - apiKey: []
paths:
  /v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Create a session webhook
      description: |
        Register a public HTTPS endpoint. Management uses the **console JWT**
        (same as `/v1/keys`) — API keys (`gw_*`) cannot create webhooks.

        The response includes `webhook.secret` once — verify deliveries with
        `X-Glasswarp-Signature` over `"{timestamp}.{body}"` and
        `X-Glasswarp-Timestamp` (reject skew > 5 minutes).

        URLs are DNS-resolved at create and again at every delivery; private /
        loopback / link-local / cloud-metadata addresses are rejected. Redirects
        are not followed. Max 5 webhooks per account.
      operationId: createWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - url
              properties:
                url:
                  type: string
                  format: uri
                  example: https://example.com/glasswarp/hooks
                events:
                  type: array
                  items:
                    type: string
                    enum:
                      - session.started
                      - session.ended
      responses:
        '201':
          description: Webhook created
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhook:
                    $ref: '#/components/schemas/ApiWebhookCreated'
                  warning:
                    type: string
        '400':
          description: Invalid URL, events, or webhook limit reached
      security:
        - userJwt: []
components:
  schemas:
    ApiWebhookCreated:
      allOf:
        - $ref: '#/components/schemas/ApiWebhook'
        - type: object
          properties:
            secret:
              type: string
              description: HMAC secret — shown only on create
              example: whsec_...
    ApiWebhook:
      type: object
      properties:
        id:
          type: string
          format: uuid
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
            enum:
              - session.started
              - session.ended
        enabled:
          type: boolean
        created_at:
          type: string
          format: date-time
        last_delivery_at:
          type: string
          format: date-time
          nullable: true
        last_status:
          type: integer
          nullable: true
        last_error:
          type: string
          nullable: true
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      description: API key in the format `gw_(live|test)_sk_<hex>`
    userJwt:
      type: http
      scheme: bearer
      description: Supabase user JWT (for console/dashboard endpoints)

````