# Create a webhook

URL: https://docs.healthcare.dev/reference/webhooks/create-a-webhook

```http
POST https://api.healthcare.dev/v1/webhooks
```

Pro plan and up (403 `plan-upgrade-required` below Pro); never counts as a billable call. Subscribe an https endpoint to events: `dataset.released` (a dataset published a release), `record.changed` (a code, NDC, RxCUI or NPI you list in `subjects` was added, changed or retired by a release) and `coverage.changed` (a material change to a Medicare coverage document; filtered to procedure codes in `subjects` when given). Only real changes are sent, never formatting-only ones. Each delivery is the matching feed item with a stable `id`, signed with the secret in this response (shown once): verify `Hdev-Webhook-Signature`, an HMAC-SHA256 of `<Hdev-Webhook-Timestamp>.<body>`. Failed deliveries are retried with backoff for about 24 hours. Up to 20 webhooks per account and 1,000 subjects each.

Requires an API key: `Authorization: Bearer hdev_live_...`. See [Authentication](/authentication).

## Request body

```json
{
  "url": "string",
  "events": [
    "dataset.released"
  ],
  "datasets": [
    "string"
  ],
  "subjects": [
    "string"
  ],
  "description": "string"
}
```

## Examples

**curl**

```sh
curl -X POST "https://api.healthcare.dev/v1/webhooks" \
  -H "Authorization: Bearer $HDEV_API_KEY"
```

**TypeScript**

```ts
const res = await fetch("https://api.healthcare.dev/v1/webhooks", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();
```

**Python**

```python
import os
import requests

res = requests.post("https://api.healthcare.dev/v1/webhooks", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()
```

## Response

Created; `secret` is shown only here

```json
{
  "data": {
    "id": "string",
    "url": "string",
    "description": "string",
    "events": [
      "dataset.released"
    ],
    "datasets": [
      "string"
    ],
    "subjects": [
      "string"
    ],
    "status": "active",
    "disabled_reason": "failing",
    "disabled_at": "string",
    "consecutive_failures": 1,
    "secret_hint": "string",
    "created_at": "string",
    "secret": "string"
  },
  "meta": {
    "source": "cms-icd10",
    "data_version": "2026.1",
    "retrieved_at": "2026-10-24T12:00:00Z",
    "license": "Public domain (CMS). Reference data, not medical advice."
  },
  "links": {
    "self": "/v1/webhooks",
    "next": null
  }
}
```

## Errors

Errors are `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)). Branch on `type`, not on `title`. See [Errors](/errors).

| Status | `type` | When |
| --- | --- | --- |
| 400 | `invalid-request` | A parameter or the body failed validation; `errors` lists each field. |
| 401 | `unauthorized` | Missing, malformed or revoked API key. |
| 403 | `plan-upgrade-required` | The plan doesn't include this feature; `required_plan` names the plan that does. |
| 404 | `not-found` | No record with that id (retired records are still returned). |
| 409 |  | The account already has 20 webhooks |
| 429 | `rate-limited / quota-exceeded` | Too many requests per second (retry after `Retry-After`), or the monthly quota is used up. |