Skip to main content
POST
Create a webhook
Safety
  • Writes data: Yes. Registers a webhook. HealOS starts sending events to url with the next matching note or document event.
  • Safe to retry: Only with an Idempotency-Key header: a repeat with the same key returns the first webhook instead of a second one.
  • Contacts an outside system: Not at creation. Later deliveries POST to your url.
  • Dry run: Not available.
Rolling out: this endpoint is on staging first and not yet on api.healos.ai.
One webhook receives one event_type; create one per event you need. url must be HTTPS on a public host (loopback, private, link-local and cloud-metadata addresses are rejected, at creation and again before every delivery). Use headers to send a shared secret your endpoint checks, for example {"Authorization": "Bearer <secret>"}. Host, Content-Type, Content-Length, User-Agent and other framing headers are set by HealOS and cannot be configured. Header values cannot be read back, so keep your copy. Webhooks belong to the user who created the API key and receive that user’s note and document events, the same as on the dashboard’s Webhooks page. A webhook of another user, in your organization or any other, is a 404. Guide: Webhooks. Errors: Error catalog.

Authorizations

X-API-Key
string
header
required

API key obtained from /api/v1/ext-api-keys

Headers

Idempotency-Key
string

Makes a retry of this request safe. A repeat with the same key and the same request within 24 hours does not run again: it returns the original status with the resource as it is now, and an Idempotent-Replayed: true header. Keys are scoped to your organization and API key. See https://docs.healos.ai/idempotency. Up to 255 printable ASCII characters. Use a new random value (a UUID) for each new request and resend the same value when you retry it.

Required string length: 1 - 255
Example:

"5f0c3a8e-2b7d-4c1e-9a64-0d3f2e1b7c90"

Body

application/json
name
string
required
Required string length: 1 - 200
Example:

"EHR sync"

url
string<uri>
required

Your HTTPS endpoint. It must resolve to a public host: loopback, private, link-local and cloud-metadata addresses are rejected.

Maximum string length: 2048
Example:

"https://hooks.example.com/healos"

event_type
enum<string>
required

The event this webhook receives. One event per webhook.

Available options:
NOTE_CREATED,
NOTE_REGENERATED,
NOTE_UPDATED,
DOCUMENT_STATUS_CHANGED
Example:

"NOTE_CREATED"

format
enum<string>

How the payload is encoded. Default JSON.

Available options:
JSON,
XML,
Form Data
Example:

"JSON"

description
string | null
Maximum string length: 1000
Example:

"Pushes new notes to our EHR bridge"

headers
object

Up to 10 static headers sent with every delivery, for example a shared secret your endpoint checks. Values are write-only: responses list the header names, never the values.

Example:

Response

Webhook created

data
object
required