> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vyomflow.co.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Set (or rotate) the caller's outbound webhook endpoint

> One `WebhookEndpoint` row per user. First call creates it and returns a server-generated `secret` in plaintext (the only time it is ever shown again). A later call without `rotateSecret` just updates `url`; `rotateSecret: true` moves the current secret into `secondarySecret` (kept valid for a grace window) and mints a fresh `secret`. Deliveries carry `X-Vyomflow-Signature: sha384=<hex(HMAC_SHA384(`${timestamp}.${rawBody}`, secret))>`, `X-Vyomflow-Timestamp`, `X-Vyomflow-Event-Id`, and `X-Vyomflow-Delivery-Attempt` for `agent.started`/`agent.completed`/`agent.failed`/`tool.completed` events.



## OpenAPI

````yaml /openapi.json post /api/v1/webhooks
openapi: 3.1.0
info:
  title: VyomFlow API
  version: 1.0.0
  description: >-
    The versioned public REST surface (`/api/public/v1/*`, bearer API-key auth)
    plus the app's own internal `/api/v1/*` surface (Clerk session-token auth),
    generated directly from the same Zod contracts the Route Handlers validate
    against — never a hand-maintained duplicate. The MCP endpoint (`/api/mcp`)
    is a separate streamable-HTTP JSON-RPC transport, not expressible here — see
    the MCP guide.
servers:
  - url: https://api.vyomflow.co.in
    description: Production
  - url: http://localhost:3000
    description: Local development
security: []
paths:
  /api/v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Set (or rotate) the caller's outbound webhook endpoint
      description: >-
        One `WebhookEndpoint` row per user. First call creates it and returns a
        server-generated `secret` in plaintext (the only time it is ever shown
        again). A later call without `rotateSecret` just updates `url`;
        `rotateSecret: true` moves the current secret into `secondarySecret`
        (kept valid for a grace window) and mints a fresh `secret`. Deliveries
        carry `X-Vyomflow-Signature:
        sha384=<hex(HMAC_SHA384(`${timestamp}.${rawBody}`, secret))>`,
        `X-Vyomflow-Timestamp`, `X-Vyomflow-Event-Id`, and
        `X-Vyomflow-Delivery-Attempt` for
        `agent.started`/`agent.completed`/`agent.failed`/`tool.completed`
        events.
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                  format: uri
                rotateSecret:
                  type: boolean
              required:
                - url
      responses:
        '200':
          description: >-
            The endpoint's current state, including the secret(s) if just
            (re)generated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          description: Malformed request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Missing or invalid credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
        - ClerkBearer: []
components:
  schemas:
    WebhookEndpoint:
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        secret:
          type: string
        secondarySecret:
          type:
            - string
            - 'null'
        enabled:
          type: boolean
        createdAt:
          type: string
        updatedAt:
          type: string
      required:
        - id
        - url
        - secret
        - secondarySecret
        - enabled
        - createdAt
        - updatedAt
    ApiError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            details: {}
          required:
            - code
            - message
      required:
        - error
  securitySchemes:
    ClerkBearer:
      type: http
      scheme: bearer
      description: >-
        Clerk session token, `Authorization: Bearer <token>` — the first-party
        browser app's own auth. Used only by this internal `/api/v1/*` surface,
        never by `/api/public/v1/*`.

````