> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onboardme.app/llms.txt
> Use this file to discover all available pages before exploring further.

# The Webhook

> A webhook subscription delivers Partner API events to your HTTPS URL. Store webhookSecret from the 201 response; it is not returned again.

A **webhook** subscription tells OnboardMe to POST JSON to your HTTPS URL when something happens in the practice. One subscription per event. Repeat the create call with the same URL to cover multiple events.

Write access is required to subscribe. List event keys first with `GET /api/v1/webhooks/events`.

See [Webhooks](/guides/webhooks).

## Attributes

<ResponseField name="id" type="uuid">
  Subscription id. Use it to test or delete the subscription.
</ResponseField>

<ResponseField name="url" type="string">
  Your HTTPS endpoint.
</ResponseField>

<ResponseField name="event" type="string">
  Event key such as `proposal.accepted` or `eform.submitted`.
</ResponseField>

<ResponseField name="webhookSecret" type="string">
  Returned **once** on create (`201`). Store it immediately. List and get routes do not return it again.
</ResponseField>

## Delivery headers

| Header           | Meaning                               |
| ---------------- | ------------------------------------- |
| `X-Om-Event`     | Event key                             |
| `X-Om-Event-Id`  | Unique id. Use as an idempotency key. |
| `X-Om-Timestamp` | Unix seconds (UTC) used when signing  |
| `X-Om-Signature` | `sha256=` HMAC (hex, lowercase)       |

Verify: `canonical = {timestamp} + "." + {rawBody}`, then HMAC-SHA256 with `webhookSecret`.

<RequestExample>
  ```json The Webhook object theme={null}
  {
    "id": "0f1e2d3c-4b5a-6978-90ab-cdef12345670",
    "url": "https://partner.example.com/webhooks/onboardme",
    "event": "proposal.accepted",
    "webhookSecret": "whsec_store_this_immediately"
  }
  ```
</RequestExample>