> ## Documentation Index > Fetch the complete documentation index at: https://docs.synci.io/llms.txt > Use this file to discover all available pages before exploring further. # Create new webhook endpoint > The endpoint's signing `secret` is included in this response only — it cannot be read again later, but can be rotated at any time. The number of webhook endpoints is subject to your plan's limits (403 when exceeded). ## OpenAPI ````yaml /openapi/v1.json post /webhooks openapi: 3.2.0 info: title: Synci version: '1.0' description: >- Synci is a platform for integrating financial accounts with your favorite apps. servers: - url: https://api.synci.io/api/v1 security: - oauth2: [] - http: [] tags: - name: Finance kind: nav - name: Connections parent: Finance - name: Accounts parent: Finance - name: Transactions parent: Finance - name: Institutions parent: Finance - name: Destinations kind: nav - name: YNAB parent: Destinations - name: Lunch Money parent: Destinations - name: Google Sheets parent: Destinations - name: SimpleFIN parent: Destinations - name: Notion parent: Destinations - name: Account kind: nav - name: Webhooks parent: Account - name: User parent: Account - name: rule-engine summary: Rules kind: nav - name: Rules parent: rule-engine - name: Rule Logs parent: rule-engine - name: Transfers kind: nav - name: Transfer Links parent: Transfers - name: Transfer Logs parent: Transfers paths: /webhooks: post: tags: - Webhooks summary: Create new webhook endpoint description: |- The endpoint's signing `secret` is included in this response only — it cannot be read again later, but can be rotated at any time. The number of webhook endpoints is subject to your plan's limits (403 when exceeded). operationId: webhooks.store requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateWebhookEndpointRequest' responses: '201': description: '' content: application/json: schema: type: object properties: message: type: string const: Webhook endpoint created. data: $ref: '#/components/schemas/WebhookEndpointResource' required: - message - data '401': $ref: '#/components/responses/AuthenticationException' '403': description: '' content: application/json: schema: type: object properties: message: type: string const: >- You have reached the limit for webhook endpoints in your current plan. Please upgrade to continue. feature: type: string const: webhook_endpoint current: type: integer minimum: 0 limit: type: - integer - boolean - string - 'null' formatted_limit: type: string required: - message - feature - current - limit - formatted_limit '422': $ref: '#/components/responses/ValidationException' components: schemas: CreateWebhookEndpointRequest: type: object properties: url: type: string format: uri description: The HTTPS URL that will receive event deliveries. maxLength: 512 description: type: - string - 'null' description: Optional label to help you identify the endpoint. maxLength: 255 enabled: type: boolean description: Whether the endpoint receives deliveries. Defaults to true. events: type: array description: |- The event types this endpoint should receive. Canonical names: `transactions.created`, `transactions.updated`, `balance.updated`, `holdings.updated`, `account.created`, `account.updated`, `account.deleted`. Legacy aliases (`bank_account.created`, `bank_account.updated`, `bank_account.deleted`) are accepted but cannot be mixed in the same array with their canonical counterparts. items: type: string enum: - transactions.created - transactions.updated - balance.updated - holdings.updated - account.created - account.updated - account.deleted - bank_account.created - bank_account.updated - bank_account.deleted - connection.created - connection.activated - connection.reauthorized - connection.expiring - connection.expired - connection.failing - connection.recovered - connection.disabled - connection.deleted minItems: 1 financial_accounts: type: - array - 'null' description: |- Limit deliveries to these financial account IDs. Omit or pass null to receive events for all accounts. items: type: integer type: $ref: '#/components/schemas/WebhookTypeEnum' description: |- `WEBHOOK` (default) for a standard endpoint, `ZAPIER` for an endpoint used with the Zapier integration, or `N8N` for an endpoint registered by the Synci n8n trigger node. payload_version: $ref: '#/components/schemas/WebhookEndpointPayloadVersion' description: >- Shape of payloads delivered to this endpoint. Defaults to `v2` (canonical `account.*` event names + `financial_account` payload key). Pass `v1` to opt into the legacy shape (`bank_account.*` event-type aliases + `bank_account` payload key) — only useful for clients migrating an existing integration. Pinned at creation; updates are ignored. If omitted, the version is inferred from the `events` array: any `bank_account.*` subscription implies `v1`, otherwise `v2`. omit_sensitive_identifiers: description: |- When true, sensitive account identifiers (IBAN/BBAN) are omitted from delivered payloads. Must be true for Zapier endpoints. enum: - 'yes' - 'on' - '1' - 1 - 'true' - true required: - url title: CreateWebhookEndpointRequest WebhookEndpointResource: type: object properties: id: type: string url: type: string description: type: string enabled: type: string type: type: string omit_sensitive_identifiers: type: string events: type: string description: >- Subscribed event types. New endpoints should use the canonical names (`transactions.created`, `transactions.updated`, `balance.updated`, `holdings.updated`, `account.created`, `account.updated`, `account.deleted`); the legacy `bank_account.*` aliases are still accepted for existing v1 integrations but should not be used in new code. financial_accounts: type: string description: |- IDs of the financial accounts this endpoint receives events for. Null or empty means events for all accounts are delivered. health: $ref: '#/components/schemas/HealthResource' secret: type: string description: |- The endpoint's signing secret. Only returned when the endpoint is created or the secret is rotated — store it securely. payload_version: type: string description: |- Shape of payloads delivered to this endpoint. Pinned at creation — not editable after. `v1` is the legacy shape (`bank_account.*` event-type aliases + `bank_account` payload embed key), kept for backwards compatibility with existing integrations. `v2` is the canonical shape (`account.*` events + `financial_account` embed key) — the default for new endpoints. created_at: type: string updated_at: type: string required: - id - url - description - enabled - type - omit_sensitive_identifiers - events - payload_version - created_at - updated_at title: WebhookEndpointResource WebhookTypeEnum: type: string description: > The kind of webhook endpoint. `WEBHOOK` is a standard HTTPS endpoint; `ZAPIER` marks an endpoint used with the Zapier integration, which must have `omit_sensitive_identifiers` enabled; `N8N` marks an endpoint registered by the Synci n8n trigger node. n8n runs on infrastructure the user controls, so unlike Zapier it keeps the default privacy setting. enum: - WEBHOOK - ZAPIER - N8N title: WebhookTypeEnum WebhookEndpointPayloadVersion: type: string description: > Selects the shape of webhook payloads delivered to a given endpoint. - `V1` is the legacy shape. Account-lifecycle events use the `bank_account.{created,updated,deleted}` event types, and every payload (including the `transactions.*`, `balance.updated`, and `holdings.updated` events) embeds the account under the `bank_account` key. Kept for backwards compatibility with existing integrations. - `V2` is the canonical shape. Account-lifecycle events use the unified `account.*` names and the account is embedded under the `financial_account` key. New endpoints default here. The payload version is fixed per endpoint when it is created and cannot be changed afterwards. enum: - v1 - v2 title: WebhookEndpointPayloadVersion HealthResource: type: object properties: status: type: string description: >- Health status: HEALTHY (last request succeeded), FAILING (recent requests failed), or DEAD (10 or more consecutive failures). integrator_message: type: string description: The most recent error message reported by the provider, if any. failure_count: type: string description: The number of consecutive failed requests. transient_message: type: string description: >- A provider-side outage currently blocking part of the sync (for example the institution being down for maintenance). Not counted as a failure: the status stays HEALTHY while Synci retries automatically. Null when nothing is being retried. transient_failure_count: type: string description: The number of consecutive sync attempts refused by that outage. last_attempt_at: type: string description: When the last sync attempt occurred. required: - status - integrator_message - failure_count - transient_message - transient_failure_count - last_attempt_at title: HealthResource responses: AuthenticationException: description: Unauthenticated content: application/json: schema: type: object properties: message: type: string description: Error overview. required: - message ValidationException: description: Validation error content: application/json: schema: type: object properties: message: type: string description: Errors overview. errors: type: object description: A detailed description of each field that failed validation. additionalProperties: type: array items: type: string required: - message - errors securitySchemes: oauth2: type: oauth2 flows: authorizationCode: authorizationUrl: https://api.synci.io/oauth/authorize tokenUrl: https://api.synci.io/oauth/token scopes: profile:read: View your name, email, and profile details accounts:read: View your connected financial accounts and balances accounts:write: >- Update, sync, and remove your financial accounts, and change their settings transactions:read: View your transactions transactions:write: Create, update, and delete your transactions sensitive:read: >- See sensitive identifiers like account numbers and account holder names transfer-links:read: View your transfer links and their transfer history transfer-links:write: Create, update, and delete transfer links, and undo transfers rules:read: View your rules and rule activity rules:write: Create, update, and delete rules, and undo rule actions webhooks:read: View your webhook endpoints webhooks:write: >- Create, update, and delete webhook endpoints, and rotate their secrets destinations:read: View your connected destinations destinations:write: Connect, update, and remove destinations financial-connections:read: View your connected institutions financial-connections:write: Manage your connected institutions http: type: http description: Bearer token (personal access token or OAuth access token) scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.