> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook endpoint

> Register an HTTPS event destination.

Required scope: `webhooks:write`. Return signing secret only once; validate destination against SSRF and tenant rules. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

**Required scope:** `webhooks:write`

Register an HTTPS event destination.

Required scope: `webhooks:write`. Return signing secret only once; validate destination against SSRF and tenant rules. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid\_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency\_result\_expired without re-execution. Different payloads return 409 idempotency\_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

[Product scope](https://docs.amlok.io/api-reference/products-and-endpoints.md) · [Processing lifecycle](https://docs.amlok.io/api-reference/processing-lifecycle.md) · [Errors](https://docs.amlok.io/api-reference/errors.md)


## OpenAPI

````yaml openapi/amlok-v1.json POST /v1/webhook-endpoints
openapi: 3.1.0
info:
  title: AMLOK API
  version: 1.4.2
  description: >-
    API reference for AMLOK 1.4.2, with example requests and responses.
    Configure your institution-issued environment URL before making requests.
  x-source-workbook: >-
    https://docs.google.com/spreadsheets/d/14pU2PLv9JDda8gAa1367hipa2oJQB260fIJthevrp10/edit
servers:
  - url: https://api.example.com
    description: Set the server URL to your institution-issued AMLOK environment URL.
security:
  - BearerAuth: []
tags:
  - name: Platform
    description: Platform operations.
  - name: Identity
    description: Identity operations.
  - name: Banking
    description: Banking operations.
  - name: Payments
    description: Payments operations.
  - name: Commerce
    description: Commerce operations.
  - name: Accounting
    description: Accounting operations.
  - name: Inventory
    description: Inventory operations.
  - name: Lending
    description: Lending operations.
  - name: Liens
    description: Liens operations.
  - name: Risk
    description: Risk operations.
  - name: Operations
    description: Operations operations.
  - name: Webhooks
    description: Webhooks operations.
  - name: Reporting
    description: Reporting operations.
paths:
  /v1/webhook-endpoints:
    post:
      tags:
        - Webhooks
      summary: Create webhook endpoint
      description: >-
        Register an HTTPS event destination.


        Required scope: `webhooks:write`. Return signing secret only once;
        validate destination against SSRF and tenant rules. Once account
        cancellation is submitted, processing and usage deductions stop
        immediately. Reject new operational commands with 409 invalid_state;
        pending work is cancelled without another debit. Read-only reporting
        remains available until workspace deletion. Accepted commands have a
        durable request receipt. Full response replay lasts 24 hours; afterward
        the same key and target return 409 idempotency_result_expired without
        re-execution. Different payloads return 409 idempotency_conflict. Use
        GET /v1/request-receipts/lookup to find the original resource. The
        fingerprint includes the resolved target path and intended payload; a
        key used on another target is rejected rather than replayed onto it.
        Pre-execution validation or insufficient-credit rejection creates no
        accepted receipt.
      operationId: EP158
      parameters:
        - name: X-Request-ID
          in: header
          required: false
          description: >-
            Optional caller correlation ID; the response includes AMLOK
            request_id.
          schema:
            type: string
          example: client-request-example
        - name: Idempotency-Key
          in: header
          required: true
          description: >-
            Reuse for retries of the same intended command and identical
            payload. Retention: 24 hours.
          schema:
            type: string
          example: idem_example_1001
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EP158Request'
            example:
              url: https://client.example.com/amlok-events
              event_types:
                - verification.completed
              description: Application events for the underwriting service
      responses:
        '201':
          description: Register an HTTPS event destination.
          headers:
            X-Request-ID:
              description: AMLOK response correlation identifier.
              schema:
                type: string
              example: req_example
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/WebhookEndpointCreated'
                  meta:
                    $ref: '#/components/schemas/ResponseMeta'
                required:
                  - data
                  - meta
              examples:
                synthetic:
                  summary: Synthetic create webhook endpoint
                  value:
                    data:
                      id: whk_example
                      url: https://client.example.com/amlok-events
                      event_types:
                        - verification.completed
                      status: active
                      secret: synthetic_webhook_secret_replace_on_provisioning
                    meta:
                      request_id: req_example
                      schema_version: 1.4.2
                      generated_at: '2026-10-23T14:00:00Z'
                      data_status: partial
        '400':
          $ref: '#/components/responses/Error400'
        '401':
          $ref: '#/components/responses/Error401'
        '403':
          $ref: '#/components/responses/Error403'
        '404':
          $ref: '#/components/responses/Error404'
        '409':
          $ref: '#/components/responses/Error409'
        '410':
          $ref: '#/components/responses/Error410'
        '422':
          $ref: '#/components/responses/Error422'
        '429':
          $ref: '#/components/responses/Error429'
        '500':
          $ref: '#/components/responses/Error500'
        '502':
          $ref: '#/components/responses/Error502'
        '503':
          $ref: '#/components/responses/Error503'
      security:
        - BearerAuth: []
      x-codeSamples:
        - lang: Shell
          label: cURL
          source: |-
            curl --request POST --fail-with-body --max-time 30 \
              "${AMLOK_API_BASE_URL}/v1/webhook-endpoints" \
              --header "Authorization: Bearer ${AMLOK_API_KEY}" \
              --header "Accept: application/json" \
              --header 'Idempotency-Key: idem_example_1001' \
              --header 'Content-Type: application/json' \
              --data '{
              "url": "https://client.example.com/amlok-events",
              "event_types": [
                "verification.completed"
              ],
              "description": "Application events for the underwriting service"
            }'
        - lang: Python
          source: |-
            import os
            import requests

            base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
            headers = {'Accept': 'application/json',
             'Idempotency-Key': 'idem_example_1001',
             'Content-Type': 'application/json'}
            headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

            response = requests.request(
                "POST", base_url + "/v1/webhook-endpoints",
                headers=headers, timeout=30, allow_redirects=False,
                json={'url': 'https://client.example.com/amlok-events',
             'event_types': ['verification.completed'],
             'description': 'Application events for the underwriting '
                            'service'},
            )
            response.raise_for_status()
            print(response.json())
        - lang: JavaScript
          label: Node.js
          source: >-

            const baseUrl = process.env.AMLOK_API_BASE_URL;

            const apiKey = process.env.AMLOK_API_KEY;

            if (!baseUrl || !apiKey) throw new Error("Configure
            AMLOK_API_BASE_URL and AMLOK_API_KEY");

            const headers = {
              "Accept": "application/json",
              "Idempotency-Key": "idem_example_1001",
              "Content-Type": "application/json"
            };

            headers.Authorization = `Bearer ${apiKey}`;

            const response = await fetch(baseUrl.replace(/\/$/, "") +
            "/v1/webhook-endpoints", {
              method: "POST", headers,
              redirect: "error", signal: AbortSignal.timeout(30000),
              body: JSON.stringify({
              "url": "https://client.example.com/amlok-events",
              "event_types": [
                "verification.completed"
              ],
              "description": "Application events for the underwriting service"
            }),

            });

            if (!response.ok) throw new Error(`AMLOK returned HTTP
            ${response.status}`);

            console.log(await response.json());
components:
  schemas:
    EP158Request:
      type: object
      properties:
        url:
          type: string
          minLength: 1
          format: uri
          pattern: ^https://
          description: HTTPS destination permitted for this tenant.
        event_types:
          type: array
          items:
            type: string
            enum:
              - business.created
              - person.created
              - connection.updated
              - consent.updated
              - sync.completed
              - sync.failed
              - verification.updated
              - verification.completed
              - document.processed
              - lien_search.completed
              - lien_search.failed
              - lien.updated
              - application.updated
              - decision.created
              - loan.updated
              - repayment.updated
              - attributes.calculated
              - risk_snapshot.created
              - monitor.updated
              - alert.created
              - alert.updated
              - workflow.completed
              - workflow.failed
              - resource.deleted
          minItems: 1
          description: Subscribed keys from Events.
        description:
          type: string
          minLength: 1
          description: Request field from the endpoint contract.
      required:
        - url
        - event_types
      additionalProperties: false
    WebhookEndpointCreated:
      type: object
      properties:
        id:
          type: string
          description: Tenant event destination identifier.
        url:
          type: string
          description: Validated HTTPS delivery destination.
        event_types:
          type: array
          items:
            type: string
          description: Subscribed event keys.
        status:
          type: string
          description: active or disabled.
        secret:
          type: string
          description: Signing secret returned once at creation only; omitted thereafter.
      required:
        - id
        - url
        - event_types
        - status
        - secret
    ResponseMeta:
      type: object
      properties:
        request_id:
          type: string
          description: AMLOK request correlation ID.
        schema_version:
          type: string
          description: Serialization contract version.
        generated_at:
          type: string
          format: date-time
          description: Response generation time, not source data freshness.
        data_status:
          $ref: '#/components/schemas/Enum_data_status'
          description: Completeness of this response within its declared scope.
        coverage:
          anyOf:
            - $ref: '#/components/schemas/Coverage'
            - type: 'null'
          description: Requested and achieved source/time coverage.
      required:
        - request_id
        - schema_version
        - generated_at
        - data_status
    Enum_data_status:
      type: string
      enum:
        - complete
        - partial
        - unavailable
        - pending
    Coverage:
      type: object
      properties:
        requested_from:
          anyOf:
            - type: string
              format: date
            - type: 'null'
          description: Inclusive start requested.
        requested_to:
          anyOf:
            - type: string
              format: date
            - type: 'null'
          description: Exclusive end requested.
        available_from:
          anyOf:
            - type: string
              format: date
            - type: 'null'
          description: Earliest actual coverage.
        available_to:
          anyOf:
            - type: string
              format: date
            - type: 'null'
          description: Exclusive end of actual coverage.
        source_ids:
          type: array
          items:
            type: string
          description: Sources actually contributing.
        missing_intervals:
          type: array
          items:
            $ref: '#/components/schemas/Interval'
          description: Known gaps within requested scope.
        jurisdictions_completed:
          anyOf:
            - type: array
              items:
                type: string
            - type: 'null'
          description: Completed geographic search scope when applicable.
      required:
        - source_ids
        - missing_intervals
    ErrorEnvelope:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
        meta:
          $ref: '#/components/schemas/ResponseMeta'
      required:
        - error
        - meta
    Interval:
      type: object
      properties:
        from:
          type: string
          format: date
          description: Inclusive interval start.
        to:
          type: string
          format: date
          description: Exclusive interval end.
      required:
        - from
        - to
    Error:
      type: object
      properties:
        code:
          type: string
          description: Stable machine-readable error code.
        message:
          type: string
          description: Safe caller-facing explanation.
        field:
          anyOf:
            - type: string
            - type: 'null'
          description: Invalid request field when relevant.
        retryable:
          type: boolean
          description: Whether retry may succeed without changing the request.
        request_id:
          type: string
          description: Correlation identifier for support.
      required:
        - code
        - message
        - retryable
        - request_id
  responses:
    Error400:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            invalid_request:
              summary: invalid_request
              value:
                error:
                  code: invalid_request
                  message: Malformed input, unknown parameter or incompatible filters.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            unsupported_parameter:
              summary: unsupported_parameter
              value:
                error:
                  code: unsupported_parameter
                  message: Historical query or filter not implemented on this resource.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            validation_error:
              summary: validation_error
              value:
                error:
                  code: validation_error
                  message: >-
                    A field, projection, or request value is invalid. Inspect
                    error.field.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error401:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            unauthenticated:
              summary: unauthenticated
              value:
                error:
                  code: unauthenticated
                  message: Missing, expired or invalid credential.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error403:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            forbidden:
              summary: forbidden
              value:
                error:
                  code: forbidden
                  message: Tenant scope or field/product entitlement missing.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error404:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            not_found:
              summary: not_found
              value:
                error:
                  code: not_found
                  message: Record does not exist or is not visible in this tenant.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error409:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            idempotency_conflict:
              summary: idempotency_conflict
              value:
                error:
                  code: idempotency_conflict
                  message: Same key was reused with different intended input.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            invalid_state:
              summary: invalid_state
              value:
                error:
                  code: invalid_state
                  message: >-
                    The operation is unavailable in the current resource or
                    account state. Operational commands are unavailable after
                    cancellation is submitted.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error410:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            cursor_expired:
              summary: cursor_expired
              value:
                error:
                  code: cursor_expired
                  message: >-
                    The synchronization cursor has expired. Begin a new
                    synchronization checkpoint and rebuild the collection
                    snapshot.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error422:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            invalid_search_scope:
              summary: invalid_search_scope
              value:
                error:
                  code: invalid_search_scope
                  message: Missing or unsupported jurisdiction/search mode.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            invalid_money:
              summary: invalid_money
              value:
                error:
                  code: invalid_money
                  message: >-
                    Invalid decimal, missing required currency or incompatible
                    currency pair.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            insufficient_evidence:
              summary: insufficient_evidence
              value:
                error:
                  code: insufficient_evidence
                  message: Required decision or metric prerequisites are missing.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
            workload_limit_exceeded:
              summary: workload_limit_exceeded
              value:
                error:
                  code: workload_limit_exceeded
                  message: >-
                    The agreed workload limit cannot cover this work. No
                    automatic tier upgrade or surcharge occurs. Contact AMLOK to
                    agree expanded scope.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error429:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
        Retry-After:
          description: >-
            Delay in seconds or an HTTP-date. The example is illustrative, not a
            contractual quota.
          schema:
            type: string
          example: '30'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            rate_limited:
              summary: rate_limited
              value:
                error:
                  code: rate_limited
                  message: AMLOK tenant quota or upstream throttle.
                  retryable: true
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error500:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            internal_error:
              summary: internal_error
              value:
                error:
                  code: internal_error
                  message: Unexpected AMLOK processing error.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error502:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            source_error:
              summary: source_error
              value:
                error:
                  code: source_error
                  message: Upstream returned invalid or failed data.
                  retryable: false
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
    Error503:
      description: Request failed. Inspect error.code and error.retryable.
      headers:
        X-Request-ID:
          description: AMLOK response correlation identifier.
          schema:
            type: string
          example: req_example
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          examples:
            source_unavailable:
              summary: source_unavailable
              value:
                error:
                  code: source_unavailable
                  message: Required source temporarily unavailable.
                  retryable: true
                  request_id: req_example
                meta:
                  request_id: req_example
                  schema_version: 1.4.2
                  generated_at: '2026-10-23T14:00:00Z'
                  data_status: complete
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API key
      description: >-
        Server-to-server API key bound to exactly one workspace, institution
        tenant and environment. No caller-supplied workspace override is
        accepted. Do not use in public browser code.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.