> ## Documentation Index > Fetch the complete documentation index at: https://docs.userecord.io/llms.txt > Use this file to discover all available pages before exploring further. # Create an endpoint > Register the HTTPS URL that receives result events. Deliveries are signed with your API secret key. **Scope:** `webhooks:manage` · **Idempotency-Key:** optional ## OpenAPI ````yaml /blue-collar-api/api-reference/openapi.json post /webhooks/endpoints openapi: 3.1.0 info: title: Record Blue Collar API version: 1.0.0 description: >- Run Record candidate verification from your own system. You need two things: your **key id** and your **secret**. Everything else is generated. See Authentication for how. servers: - url: https://api-bc.userecord.io/api/v1/partner description: Blue Collar API security: [] tags: - name: Skills description: The skill taxonomy, read live a page at a time - name: Skill requests description: Ask Record to add a missing skill - name: Lookups description: >- Lookups for filling in a job mandate: places in India, the countries an abroad job can be in, and the employment types and shifts the playground offers - name: Workflows description: >- Your organisation's blue-collar workflows (read all; change and soft-delete only the ones you created) - name: Job mandates description: >- Your organisation's job mandates, addressed by Record's mandate_id (read all; change only the ones you created) - name: Campaigns description: Contact candidates for one of your jobs and verify them. Spends credits - name: Results description: >- What Record collected from each candidate: status (pending, completed, declined, failed) and an output of answers and verdicts - name: Events description: >- Pull your result events and acknowledge them: the safety net behind the webhook, and a way to receive results without exposing a URL - name: Webhooks description: >- Endpoints that Record POSTs result events to: signed, retried until you acknowledge, replayable - name: Analytics description: >- The workflow Overview analytics of the Record playground: funnel, channels, follow-ups, calls, drop-offs, languages (read-only, scope analytics:read) paths: /webhooks/endpoints: post: tags: - Webhooks summary: Create an endpoint description: >- Register the HTTPS URL that receives result events. Deliveries are signed with your API secret key. **Scope:** `webhooks:manage` · **Idempotency-Key:** optional operationId: createWebhookEndpoint parameters: - name: Idempotency-Key in: header required: false schema: type: string maxLength: 255 description: >- Optional. A retry with the same key returns the first answer (kept 24 h). Leave empty in Try it: a new one is made for every call. requestBody: required: true content: application/json: schema: type: object properties: url: type: string maxLength: 2048 description: >- Your HTTPS endpoint (port 443, public host). Record POSTs each event here and counts any 2xx as the acknowledgement description: type: string maxLength: 200 description: Up to 200 characters. event_types: type: array items: type: string enum: - candidate.result minItems: 1 maxItems: 1 description: 'Default: candidate.result' uniqueItems: true backfill_from: type: string format: date-time description: Also deliver events from this time on (at most 30 days back) required: - url additionalProperties: false example: url: https://ats.example.com/hooks/record description: Production ATS event_types: - candidate.result responses: '201': description: The endpoint (the existing one when this URL was already registered) content: application/json: schema: type: object properties: success: const: true type: boolean message: type: string data: type: object properties: endpoint: type: object properties: endpoint_id: type: string url: type: string description: type: string event_types: type: array items: type: string status: type: string enum: - active - paused - auto_paused - disabled description: >- auto_paused: Record stopped sending after 20 failures in a row. Fix the endpoint, then PATCH status active paused_reason: anyOf: - type: string - type: 'null' consecutive_failures: type: integer last_success_at: anyOf: - type: string - type: 'null' last_failure_at: anyOf: - type: string - type: 'null' created_at: type: string existing: type: boolean description: >- true when this URL was already registered: nothing new was created example: success: true data: endpoint: endpoint_id: we_3f9a1c7e5b2d4086a1b3c5d7e9f01234 url: https://ats.example.com/hooks/record description: Production ATS event_types: - candidate.result status: active paused_reason: null consecutive_failures: 0 last_success_at: '2026-10-05T12:41:12.000Z' last_failure_at: null created_at: '2026-10-01T08:00:00.000Z' existing: false '400': description: >- `VALIDATION_FAILED`: URL not https, a private address, a port other than 443, or an unknown event type. content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: '`LIMIT_EXCEEDED`: Already 5 endpoints.' content: application/json: schema: $ref: '#/components/schemas/Error' security: - ApiKey: [] SecretKey: [] x-codeSamples: - lang: bash label: cURL source: |- pcall POST "/api/v1/partner/webhooks/endpoints" '{ "url": "https://ats.example.com/hooks/record", "description": "Production ATS", "event_types": [ "candidate.result" ] }' - lang: javascript label: JavaScript source: >- const res = await call("POST", "/api/v1/partner/webhooks/endpoints", { "url": "https://ats.example.com/hooks/record", "description": "Production ATS", "event_types": [ "candidate.result" ] }); const { data } = await res.json(); - lang: python label: Python source: |- res = call("POST", "/api/v1/partner/webhooks/endpoints", { "url": "https://ats.example.com/hooks/record", "description": "Production ATS", "event_types": [ "candidate.result" ] }) data = res.json()["data"] components: schemas: Error: type: object properties: success: const: false type: boolean error: type: object properties: code: type: string enum: - VALIDATION_FAILED - LIMIT_EXCEEDED - UNAUTHORIZED - SCOPE_MISSING - FORBIDDEN - HTTPS_REQUIRED - NOT_FOUND - CONFLICT - WORKFLOW_IN_USE - INSUFFICIENT_CREDITS - IDEMPOTENCY_KEY_REQUIRED - IDEMPOTENCY_KEY_REUSED - IDEMPOTENCY_IN_PROGRESS - PAYLOAD_TOO_LARGE - UNSUPPORTED_MEDIA_TYPE - RATE_LIMITED - COOLDOWN - DAILY_CAP - SERVICE_DISABLED - SERVER_ERROR message: type: string details: type: array items: type: object properties: path: type: string message: type: string request_id: type: string description: Quote it to Record support securitySchemes: ApiKey: type: apiKey in: header name: x-api-key description: Your key id, `VFN_TEST_…` or `VFN_LIVE_…`. Sent on every request. SecretKey: type: apiKey in: header name: x-secret-key description: >- Your secret, `VFN_SK_…`. **Not a real header, and never sent to the API.** It is only a form field for Try it, which uses it to sign your request in your browser. In your own code you sign each request with the secret and send `x-api-key`, `x-timestamp` and `x-signature` (see Authentication). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.