curl -X POST https://api.ibubbl.com/v1/webhooks \
  -H "Authorization: Bearer $IBUBBL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.example.com/ibubbl-webhooks",
    "event_types": ["message.sent", "message.failed", "message.inbound"]
  }'

const res = await fetch("https://api.ibubbl.com/v1/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.IBUBBL_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://api.example.com/ibubbl-webhooks",
    event_types: ["message.sent", "message.failed", "message.inbound"],
  }),
  signal: AbortSignal.timeout(10_000),
});

const data = await res.json();
if (!res.ok) throw new Error(`${res.status} ${data.detail?.error}`);
// Store data.secret now: it is never shown again.
console.log(data.id, data.secret_prefix);

import os

import requests

API_KEY = os.environ["IBUBBL_API_KEY"]

res = requests.post(
    "https://api.ibubbl.com/v1/webhooks",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "url": "https://api.example.com/ibubbl-webhooks",
        "event_types": ["message.sent", "message.failed", "message.inbound"],
    },
    timeout=10,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{res.status_code} {data['detail']['error']}")
# Store data["secret"] now: it is never shown again.
print(data["id"], data["secret_prefix"])

{
  "id": "4a5b6c7d-8e9f-0a1b-2c3d-4e5f6a7b8c9d",
  "url": "https://api.example.com/ibubbl-webhooks",
  "secret_prefix": "whsec_a3f2c8d9",
  "event_types": [
    "message.sent",
    "message.failed",
    "message.inbound"
  ],
  "created_at": "2026-11-05T14:23:45.123Z",
  "last_delivered_at": null,
  "revoked_at": null,
  "secret": "whsec_a3f2c8d9e0f1b4d52c8a1f4e23b9d4f7ca8e51d2c3b4a5e6f7a8b9c0d1e2f3a4",
  "warning": "Save this secret now — it cannot be retrieved again. Use it to verify the X-iBubbl-Signature header on incoming webhook POSTs (HMAC-SHA256 over `{t}.{raw body}`)."
}

{
  "detail": {
    "error": "invalid_url",
    "message": "Webhook URL must start with https://"
  }
}