> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tela.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create webhook subscription

> Creates a webhook subscription on a Workstation application. Whenever one of the subscribed `events` happens on a task of that application, Tela sends an HTTP request to `url` with the event payload as JSON body.



## OpenAPI

````yaml POST /prompt-application/{id}/webhooks
openapi: 3.0.1
info:
  title: Tela API
  license:
    name: MIT
  version: 1.0.0
servers:
  - url: https://api.tela.com
security: []
paths:
  /prompt-application/{id}/webhooks:
    post:
      tags:
        - Webhook
      summary: Create webhook subscription
      description: >
        Creates a webhook subscription on a Workstation application. Whenever
        one of the subscribed `events`

        happens on a task of that application, Tela sends an HTTP request to
        `url` with the

        [event payload](#/components/schemas/WebhookEventPayload) as JSON body.


        Authentication of the outgoing request is done through `headers`: every
        key/value pair is sent verbatim

        on each delivery (for example `authorization: Bearer <token>` or
        `x-api-key: <key>`). Tela does not sign

        payloads; validate the request on your side with the headers you
        configure. Headers forwarded from the

        originating API call via the `x-tela-forward-*` prefix are merged on top
        of the configured ones.


        The `url` must not point to localhost or private network ranges, and
        must use HTTPS in production.
      operationId: createWebhook
      parameters:
        - $ref: '#/components/parameters/WebhookPromptApplicationIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookCreateRequest'
      responses:
        '201':
          description: Webhook created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '400':
          $ref: '#/components/responses/WebhookBadRequest'
        '401':
          $ref: '#/components/responses/WebhookUnauthorized'
        '403':
          $ref: '#/components/responses/WebhookForbidden'
        '404':
          description: Application not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          $ref: '#/components/responses/WebhookValidationError'
        '500':
          description: >-
            The URL was rejected (private network, non-HTTPS in production, or
            malformed). Currently surfaced as a server error rather than `400`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      callbacks:
        taskEvent:
          '{$request.body#/url}':
            post:
              summary: Event delivery
              description: >
                Sent by Tela to the subscribed URL for each subscribed event.
                Uses the configured `method`

                (default `POST`), `Content-Type: application/json`, the
                configured `headers`, and any

                `x-tela-forward-*` headers from the originating request. Times
                out after 30 seconds.

                Deliveries answered with a 4xx status are not retried; other
                failures are retried by the

                delivery worker.
              requestBody:
                required: true
                content:
                  application/json:
                    schema:
                      $ref: '#/components/schemas/WebhookEventPayload'
              responses:
                2XX:
                  description: >-
                    Acknowledge the event. Any 2xx status marks the delivery as
                    `success`.
              method: post
              type: path
            path: '{$request.body#/url}'
      security:
        - bearerAuth: []
components:
  parameters:
    WebhookPromptApplicationIdPath:
      name: id
      in: path
      required: true
      description: Workstation application ID
      schema:
        type: string
        format: uuid
  schemas:
    WebhookCreateRequest:
      type: object
      properties:
        name:
          type: string
          maxLength: 256
          description: Display name of the subscription.
        url:
          type: string
          maxLength: 2048
          description: >-
            Endpoint URL. Must not resolve to localhost or private network
            ranges; HTTPS is required in production.
        events:
          type: array
          minItems: 0
          items:
            $ref: '#/components/schemas/WebhookEventType'
          description: Events to subscribe to.
        headers:
          type: object
          nullable: true
          additionalProperties:
            type: string
          description: >-
            Headers sent with every delivery (authentication tokens, correlation
            ids, ...).
        sensitiveHeaders:
          type: array
          items:
            type: string
          description: Names of the `headers` you consider sensitive. Defaults to `[]`.
        method:
          type: string
          nullable: true
          maxLength: 10
          description: HTTP method for deliveries. Defaults to `POST`.
        isActive:
          type: boolean
          description: Defaults to `true`.
        promptApplicationId:
          type: string
          format: uuid
          nullable: true
          description: Ignored; the application is taken from the path.
      required:
        - name
        - url
        - events
      example:
        name: ERP sync
        url: https://erp.example.com/hooks/tela
        events:
          - task.completed
          - task.approved
        headers:
          authorization: Bearer erp-webhook-token
        sensitiveHeaders:
          - authorization
    Webhook:
      type: object
      description: A webhook subscription of a Workstation application.
      properties:
        id:
          type: string
          format: uuid
        promptApplicationId:
          type: string
          format: uuid
          nullable: true
          description: Application the webhook belongs to.
        name:
          type: string
          maxLength: 256
        url:
          type: string
          maxLength: 2048
          description: Endpoint that receives the events.
        events:
          type: array
          items:
            $ref: '#/components/schemas/WebhookEventType'
        headers:
          type: object
          nullable: true
          additionalProperties:
            type: string
          description: >-
            Headers sent verbatim with every delivery. Use them for
            authentication (for example `authorization` or `x-api-key`).
        sensitiveHeaders:
          type: array
          items:
            type: string
          description: >-
            Names of headers considered sensitive. Stored as provided; the API
            does not currently mask them in responses.
        method:
          type: string
          nullable: true
          maxLength: 10
          description: HTTP method used for deliveries. Defaults to `POST`.
        isActive:
          type: boolean
          description: Inactive webhooks receive no deliveries.
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        deletedAt:
          type: string
          format: date-time
          nullable: true
      required:
        - id
        - promptApplicationId
        - name
        - url
        - events
        - headers
        - sensitiveHeaders
        - method
        - isActive
        - createdAt
        - updatedAt
        - deletedAt
      example:
        id: 7d8e9f0a-1b2c-4d3e-8f4a-5b6c7d8e9f0a
        promptApplicationId: c1d2e3f4-a5b6-4c7d-8e9f-0a1b2c3d4e5f
        name: ERP sync
        url: https://erp.example.com/hooks/tela
        events:
          - task.completed
          - task.approved
        headers:
          authorization: Bearer erp-webhook-token
          x-source: tela
        sensitiveHeaders:
          - authorization
        method: POST
        isActive: true
        createdAt: '2025-06-10T08:00:00.000Z'
        updatedAt: '2025-06-10T08:00:00.000Z'
        deletedAt: null
    Error: {}
    WebhookEventPayload:
      type: object
      description: >
        JSON body Tela sends to your endpoint for every event. `inputContent`
        and `outputContent` are present

        when the task has them; `errorMessage` is present for `task.failed`.
        `outputContent` is the task result:

        a string for plain-text outputs, or an object/array for structured
        outputs.
      properties:
        id:
          type: string
          format: uuid
          description: >-
            Unique id of this notification. Use it for deduplication; resends
            get a new id.
        event:
          $ref: '#/components/schemas/WebhookEventType'
        timestamp:
          type: string
          format: date-time
          description: When the notification was sent.
        task:
          $ref: '#/components/schemas/WebhookEventTask'
        inputContent:
          nullable: true
          allOf:
            - $ref: '#/components/schemas/WebhookEventInputContent'
        outputContent:
          nullable: true
          description: >-
            Task result. String, object or array depending on the canvas output
            format.
          oneOf:
            - type: string
            - type: object
            - type: array
              items: {}
        errorMessage:
          type: string
          description: Failure reason, present on `task.failed`.
      required:
        - id
        - event
        - timestamp
        - task
      example:
        id: 4f5a6b7c-8d9e-4f0a-b1c2-d3e4f5a6b7c8
        event: task.completed
        timestamp: '2025-06-11T14:03:12.000Z'
        task:
          id: b83b1558-de5b-4e45-b517-7bececbdd154
          name: Contract 42 review
          status: completed
          reference: 42
          createdAt: '2025-06-11T14:00:01.000Z'
          updatedAt: '2025-06-11T14:03:11.000Z'
          approvedAt: null
          approvedBy: null
          approvalRevokedAt: null
          approvalRevokedBy: null
        inputContent:
          variables:
            document:
              files:
                - file_name: contract-42.pdf
                  file_url: https://files.example.com/contract-42.pdf
                  mime_type: application/pdf
          files:
            - name: document
              usedAt: variables
              filename: contract-42.pdf
              mimeType: application/pdf
              url: vault://a1b2c3d4
              pages: 12
          messages: []
        outputContent:
          summary: Twelve-month services agreement with a 30-day termination clause.
          risk: low
    WebhookEventType:
      type: string
      enum:
        - task.completed
        - task.approved
        - task.approval-revoke
        - task.failed
      description: >
        Events a webhook can subscribe to:

        - `task.completed` — a task run finished successfully and is ready for
        review.

        - `task.approved` — a task was reviewed and approved.

        - `task.approval-revoke` — an approved task was sent back to
        `validating`.

        - `task.failed` — a task run ended with a failure (`errorMessage` is set
        in the payload).
    WebhookEventTask:
      type: object
      description: Snapshot of the task at the time of the event.
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        status:
          type: string
          description: >-
            Task status. Known values are `created`, `running`, `validating`,
            `completed`, `failed` and `cancelled`.
        reference:
          nullable: true
          description: Human-readable task reference number.
          oneOf:
            - type: integer
            - type: string
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        approvedAt:
          type: string
          format: date-time
          nullable: true
        approvedBy:
          type: string
          nullable: true
          description: Email of the reviewer who approved the task.
        approvalRevokedAt:
          type: string
          format: date-time
          nullable: true
        approvalRevokedBy:
          type: string
          nullable: true
      required:
        - id
        - name
        - status
        - createdAt
        - updatedAt
    WebhookEventInputContent:
      type: object
      description: The input the task was executed with.
      properties:
        variables:
          type: object
          additionalProperties: true
        messages:
          type: array
          items:
            type: object
        files:
          type: array
          items:
            $ref: '#/components/schemas/WebhookEventInputFile'
    WebhookEventInputFile:
      type: object
      description: A file that was part of the task input. All fields are optional.
      properties:
        name:
          type: string
          description: Name of the variable the file was provided through.
        type:
          type: string
        usedAt:
          type: string
          enum:
            - variables
            - messages
        url:
          type: string
        mimeType:
          type: string
        jobId:
          type: string
        filename:
          type: string
        pages:
          type: number
        filePagesAsImage:
          type: array
          items:
            type: string
        parserData:
          type: object
          description: >-
            Result of the document parser for this file (status, extracted text,
            page count, ...).
  responses:
    WebhookBadRequest:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    WebhookUnauthorized:
      description: Missing or invalid API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    WebhookForbidden:
      description: The key does not have the required role
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    WebhookValidationError:
      description: Request body or query failed schema validation (`code` is `VALIDATION`)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT or UUID

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.