> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook > source_type servicenow registers a ServiceNow webhook on a ServiceNow gateway of the organization, for one table. The gateway needs servicenow_assigned_group_id in its metadata. Without servicenow_admin, the response carries the secret and the Business Rule to add to ServiceNow. With servicenow_admin, a ServiceNow account allowed to write Business Rules, 2501 creates the rule in the instance of the gateway and does not store the account; The rule is named 2501_wh__, cut at 40 characters; 409 when a rule with that name already exists. When ServiceNow refuses the call, as with a wrong admin password, the answer is 400 and no webhook is kept. When ServiceNow gives no answer or a 5xx, the answer is 502 and the webhook is kept, because the rule may have been created before the failure: call DELETE /api/v1/webhooks/{id} with servicenow_admin to remove both. source_type splunk creates the organization's signal key for POST /api/v1/signals. The secret and the key are in this response only. ## OpenAPI ````yaml /0.19/openapi.json post /api/v1/webhooks openapi: 3.0.3 info: title: 2501 Public API version: v1 description: >- The stable, versioned HTTP API for driving 2501 as code. See the API Overview for authentication, the org_id rule, cursor pagination, and the error envelope. servers: - url: https://{command_center_host} variables: command_center_host: default: your-command-center-host description: Your Command Center host security: - bearerAuth: [] paths: /api/v1/webhooks: post: tags: - Webhooks summary: Create a webhook description: >- source_type servicenow registers a ServiceNow webhook on a ServiceNow gateway of the organization, for one table. The gateway needs servicenow_assigned_group_id in its metadata. Without servicenow_admin, the response carries the secret and the Business Rule to add to ServiceNow. With servicenow_admin, a ServiceNow account allowed to write Business Rules, 2501 creates the rule in the instance of the gateway and does not store the account; The rule is named 2501_wh__, cut at 40 characters; 409 when a rule with that name already exists. When ServiceNow refuses the call, as with a wrong admin password, the answer is 400 and no webhook is kept. When ServiceNow gives no answer or a 5xx, the answer is 502 and the webhook is kept, because the rule may have been created before the failure: call DELETE /api/v1/webhooks/{id} with servicenow_admin to remove both. source_type splunk creates the organization's signal key for POST /api/v1/signals. The secret and the key are in this response only. requestBody: required: true content: application/json: schema: oneOf: - type: object properties: source_type: type: string enum: - servicenow org_id: type: string gateway_id: type: string event_type: type: string enum: - incident - change_request name: type: string minLength: 1 maxLength: 40 servicenow_admin: type: object properties: username: type: string minLength: 1 password: type: string minLength: 1 required: - username - password additionalProperties: false description: >- A ServiceNow account allowed to write Business Rules. When present, 2501 creates or deletes the Business Rule in the instance of the gateway. Used for this request only: never stored, logged or returned. required: - source_type - org_id - gateway_id - event_type - name - type: object properties: source_type: type: string enum: - splunk org_id: type: string name: type: string minLength: 1 required: - source_type - org_id - name responses: '200': description: The created webhook content: application/json: schema: $ref: '#/components/schemas/WebhookCreated' '400': description: >- Bad request - a field is missing, malformed, or not allowed (VALIDATION_FAILED, BAD_REQUEST, INVALID_CURSOR) content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- No credentials, or a key that is invalid, revoked, or expired (UNAUTHORIZED) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Authenticated but not allowed (FORBIDDEN, ORG_ACCESS_DENIED, STEP_UP_REFUSED, TWO_FACTOR_ENROLLMENT_REQUIRED, LICENSE_CAP_REACHED, LICENSE_EXPIRED) content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such row that this caller can see (NOT_FOUND) content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The write conflicts with existing data (CONFLICT, DUPLICATE_KEY, FOREIGN_KEY_VIOLATION, RESOURCE_IN_USE) content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: >- An external system the request reaches refused it or did not answer (ENGINE_ERROR) content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: WebhookCreated: allOf: - $ref: '#/components/schemas/Webhook' - type: object properties: url: type: string description: >- Where the source system sends its events: the ingest URL for ServiceNow, the signal intake for Splunk example: >- https://cmd.example.com/api/webhooks/ingest/4f8a2c1e9b3d7a0f6e5c8d2b secret: type: string description: >- ServiceNow only: the shared secret ServiceNow sends in X-Webhook-Secret. Shown once; later reads do not return it. key: type: string description: >- Splunk only: the signal key Splunk sends as a bearer token. Shown once; only a one-way copy is stored. example: 2501_wh_... business_rule_created: type: boolean description: >- ServiceNow only: true when 2501 created the Business Rule in the instance with servicenow_admin, false when business_rule is returned for you to add. business_rule: type: object additionalProperties: nullable: true description: >- ServiceNow without servicenow_admin only: the Business Rule (a sys_script record) that sends records assigned to the gateway group to url. POST it as is to your instance at /api/now/table/sys_script, or copy its script into a rule by hand. It carries the secret. example: name: 2501_wh_prod_incidents collection: incident active: true advanced: true when: after action_insert: true action_update: true filter_condition: assignment_group=net-ops^active=true script: >- (function executeRule(current, previous) { ... })(current, previous); order: 100 required: - url Error: type: object properties: code: type: string example: VALIDATION_FAILED message: type: string example: Validation failed request_id: type: string example: req_3702b7e7-... field: type: string description: Set when one input is at fault errors: type: array items: type: object properties: field: type: string message: type: string required: - field - message description: Set when several inputs are at fault details: type: object additionalProperties: nullable: true required: - code - message - request_id Webhook: type: object properties: id: type: string example: whk_9c31e07b-... name: type: string example: prod-incidents source_type: type: string enum: - servicenow - splunk event_type: type: string description: >- The ServiceNow table the Business Rule watches (incident or change_request), or alert for Splunk example: incident path: type: string nullable: true description: 'ServiceNow only: the ingest path this webhook answers on' example: 4f8a2c1e9b3d7a0f6e5c8d2b org_id: type: string example: org_460b541c-... tenant_id: type: string example: ten_115bea44-... gateway_id: type: string nullable: true example: gtw_6a2d4f81-... description: 'ServiceNow only: the gateway the tickets go to' last_used_at: type: string nullable: true format: date-time example: '2026-08-26T10:00:26.380Z' created_at: type: string format: date-time example: '2026-08-26T10:00:26.380Z' updated_at: type: string format: date-time example: '2026-08-26T10:00:26.380Z' required: - id - name - source_type - event_type - path - org_id - tenant_id - gateway_id - last_used_at - created_at - updated_at securitySchemes: bearerAuth: type: http scheme: bearer description: >- An API key minted in Command Center (Settings -> API Keys), sent as `Authorization: Bearer 2501_ak_...`. A Command Center session cookie is also accepted. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.