Skip to main content
POST
Create a webhook

Authorizations

Authorization
string
header
required

An API key minted in Command Center (Settings -> API Keys), sent as Authorization: Bearer 2501_ak_.... A Command Center session cookie is also accepted.

Body

application/json
source_type
enum<string>
required
Available options:
servicenow
org_id
string
required
gateway_id
string
required
event_type
enum<string>
required
Available options:
incident,
change_request
name
string
required
Required string length: 1 - 40
servicenow_admin
object

A ServiceNow account allowed to write Business Rules. When present, 2501 creates or deletes the Business Rule in the instance of the gateway. Used for this request only: never stored, logged or returned.

Response

The created webhook

id
string
required
Example:

"whk_9c31e07b-..."

name
string
required
Example:

"prod-incidents"

source_type
enum<string>
required
Available options:
servicenow,
splunk
event_type
string
required

The ServiceNow table the Business Rule watches (incident or change_request), or alert for Splunk

Example:

"incident"

path
string | null
required

ServiceNow only: the ingest path this webhook answers on

Example:

"4f8a2c1e9b3d7a0f6e5c8d2b"

org_id
string
required
Example:

"org_460b541c-..."

tenant_id
string
required
Example:

"ten_115bea44-..."

gateway_id
string | null
required

ServiceNow only: the gateway the tickets go to

Example:

"gtw_6a2d4f81-..."

last_used_at
string<date-time> | null
required
Example:

"2026-08-26T10:00:26.380Z"

created_at
string<date-time>
required
Example:

"2026-08-26T10:00:26.380Z"

updated_at
string<date-time>
required
Example:

"2026-08-26T10:00:26.380Z"

url
string
required

Where the source system sends its events: the ingest URL for ServiceNow, the signal intake for Splunk

Example:

"https://cmd.example.com/api/webhooks/ingest/4f8a2c1e9b3d7a0f6e5c8d2b"

secret
string

ServiceNow only: the shared secret ServiceNow sends in X-Webhook-Secret. Shown once; later reads do not return it.

key
string

Splunk only: the signal key Splunk sends as a bearer token. Shown once; only a one-way copy is stored.

Example:

"2501_wh_..."

business_rule_created
boolean

ServiceNow only: true when 2501 created the Business Rule in the instance with servicenow_admin, false when business_rule is returned for you to add.

business_rule
object

ServiceNow without servicenow_admin only: the Business Rule (a sys_script record) that sends records assigned to the gateway group to url. POST it as is to your instance at /api/now/table/sys_script, or copy its script into a rule by hand. It carries the secret.

Example: