> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookstream.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a source

Create a new webhook source. Optionally apply a template for pre-configured verification.

` POST /sources `

Create a source

Create a new webhook source. Optionally apply a template for pre-configured verification.

## Servers

- ` https://hookstream.io/v1 ` — Production

## Authentication

The operation accepts these alternatives. Schemes within one alternative are required together.

### Alternative 1

- ` apiKey `: ` apiKey `

  - Credential: ` X-API-Key ` in ` header `

  - API key (format: hs_live_<64hex> or hs_test_<64hex>)

### Alternative 2

- ` cookieAuth `: ` apiKey `

  - Credential: ` better-auth.session_token ` in ` cookie `

  - Session cookie (browser auth)

## Request body (required)

Content type: ` application/json `

Request body

- ` value `: type ` object `

  - Required fields: ` name `, ` slug `

  - ` org_id `: type ` string ` — Organization ID (defaults to auth context)

  - ` env_id `: type ` string ` — Environment ID (defaults to auth context)

  - ` name `: type ` string ` — Source name

    - minLength: ` 1 `

  - ` slug `: type ` string ` — URL-safe slug

    - example: ` "my-source" `

    - minLength: ` 1 `

  - ` description `: type ` string ` — Source description

  - ` template `: type ` string ` — Template slug (e.g. stripe, github)

  - ` type `: type ` string ` — Source type

    - enum: ` ["http","websocket"] `

    - default: ` "http" `

  - ` source_config `: type ` object ` — Provider-specific config

  - ` verification_enabled `: type ` boolean ` — Enable signature verification

  - ` verification_type `: type ` string ` — Verification algorithm

  - ` verification_secret `: type ` string ` — Verification secret

  - ` verification_header `: type ` string ` — Header containing signature

  - ` dedup_enabled `: type ` boolean ` — Enable deduplication

  - ` dedup_strategy `: type ` string ` — Dedup strategy

  - ` dedup_field `: type ` string ` — Dedup field path

  - ` dedup_window_seconds `: type ` number ` — Dedup window in seconds

  - ` ip_allowlist `: type ` array ` — Allowed IP CIDRs

    - ` array item `: type ` string `

  - ` ip_denylist `: type ` array ` — Denied IP CIDRs

    - ` array item `: type ` string `

## Responses

### ` 201 ` — Created source

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` source `

  - ` source `: type ` object `; nullable

    - Required fields: ` id `, ` org_id `, ` env_id `, ` slug `, ` name `, ` description `, ` template `, ` verification_enabled `, ` verification_type `, ` verification_secret `, ` verification_header `, ` verification_config `, ` dedup_enabled `, ` dedup_strategy `, ` dedup_field `, ` dedup_window_seconds `, ` ip_allowlist `, ` ip_denylist `, ` status `, ` event_count `, ` last_event_at `, ` created_at `, ` updated_at `, ` is_ephemeral `, ` expires_at `, ` request_limit `, ` type `, ` source_config `, ` schema_validation_enabled `, ` json_schema `, ` schema_action `

    - ` id `: type ` string `

    - ` org_id `: type ` string `

    - ` env_id `: type ` string `

    - ` slug `: type ` string `

    - ` name `: type ` string `

    - ` description `: type ` string `; nullable

    - ` template `: type ` string `; nullable

    - ` verification_enabled `: type ` integer `

    - ` verification_type `: type ` string `; nullable

    - ` verification_secret `: type ` string `; nullable

    - ` verification_header `: type ` string `; nullable

    - ` verification_config `: type ` string `; nullable

    - ` dedup_enabled `: type ` integer `

    - ` dedup_strategy `: type ` string `; nullable

    - ` dedup_field `: type ` string `; nullable

    - ` dedup_window_seconds `: type ` integer `

    - ` ip_allowlist `: type ` string `; nullable

    - ` ip_denylist `: type ` string `; nullable

    - ` status `: type ` string `

    - ` event_count `: type ` integer `

    - ` last_event_at `: type ` string `; nullable

    - ` created_at `: type ` string `

    - ` updated_at `: type ` string `

    - ` is_ephemeral `: type ` integer `

    - ` expires_at `: type ` string `; nullable

    - ` request_limit `: type ` integer `; nullable

    - ` type `: type ` string `

    - ` source_config `: type ` string `; nullable

    - ` schema_validation_enabled `: type ` integer `

    - ` json_schema `: type ` string `; nullable

    - ` schema_action `: type ` string `; nullable

### ` 400 ` — Validation error

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string ` — Error message

### ` 401 ` — Unauthorized

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string ` — Error message

### ` 403 ` — Plan limit reached

Content type: ` application/json `

- ` value `: type ` object `

  - Required fields: ` error `

  - ` error `: type ` string `

  - ` upgrade_url `: type ` string `

## Request examples

### cURL

```curl
curl -X POST 'https://hookstream.io/v1/sources' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
  "org_id": "string",
  "env_id": "string",
  "name": "string",
  "slug": "my-source",
  "description": "string",
  "template": "string",
  "type": "http",
  "source_config": {},
  "verification_enabled": true,
  "verification_type": "string",
  "verification_secret": "string",
  "verification_header": "string",
  "dedup_enabled": true,
  "dedup_strategy": "string",
  "dedup_field": "string",
  "dedup_window_seconds": 0,
  "ip_allowlist": [
    "string"
  ],
  "ip_denylist": [
    "string"
  ]
}'
```

### JavaScript

```javascript
const response = await fetch('https://hookstream.io/v1/sources', {
  method: 'POST',
  headers: {
      "Authorization": "Bearer YOUR_API_TOKEN",
      "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "org_id": "string",
    "env_id": "string",
    "name": "string",
    "slug": "my-source",
    "description": "string",
    "template": "string",
    "type": "http",
    "source_config": {},
    "verification_enabled": true,
    "verification_type": "string",
    "verification_secret": "string",
    "verification_header": "string",
    "dedup_enabled": true,
    "dedup_strategy": "string",
    "dedup_field": "string",
    "dedup_window_seconds": 0,
    "ip_allowlist": [
      "string"
    ],
    "ip_denylist": [
      "string"
    ]
  })
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

headers = {
    'Authorization': 'Bearer YOUR_API_TOKEN'
}

response = requests.post('https://hookstream.io/v1/sources', headers=headers, json={
  "org_id": "string",
  "env_id": "string",
  "name": "string",
  "slug": "my-source",
  "description": "string",
  "template": "string",
  "type": "http",
  "source_config": {},
  "verification_enabled": true,
  "verification_type": "string",
  "verification_secret": "string",
  "verification_header": "string",
  "dedup_enabled": true,
  "dedup_strategy": "string",
  "dedup_field": "string",
  "dedup_window_seconds": 0,
  "ip_allowlist": [
    "string"
  ],
  "ip_denylist": [
    "string"
  ]
})
print(response.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
  "org_id": "string",
  "env_id": "string",
  "name": "string",
  "slug": "my-source",
  "description": "string",
  "template": "string",
  "type": "http",
  "source_config": {},
  "verification_enabled": true,
  "verification_type": "string",
  "verification_secret": "string",
  "verification_header": "string",
  "dedup_enabled": true,
  "dedup_strategy": "string",
  "dedup_field": "string",
  "dedup_window_seconds": 0,
  "ip_allowlist": [
    "string"
  ],
  "ip_denylist": [
    "string"
  ]
}`)
	req, _ := http.NewRequest("POST", "https://hookstream.io/v1/sources", body)
	req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	result, _ := io.ReadAll(resp.Body)
	fmt.Println(string(result))
}
```