coss.comdocs

Create an endpoint

POST
/v1/hooks/applications/{application}/endpoints

Registers a URL of the application's user that receives its messages, each request signed (Standard Webhooks) with the endpoint's own secret, returned here. Usually your users add endpoints themselves in the portal. Hooks resources belong to the API key's own environment: a coss_test_… key only ever sees sandbox ones, a coss_live_… key only production ones.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Path Parameters

application*string

The application's id (happ_…) or your uid for it.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
url*string
Lengthlength <= 2048
description?string
Lengthlength <= 256
filter_types?array<>

Event types delivered to this endpoint (existing, unarchived ones). An empty array means every type, including ones added later.

Itemsitems <= 250
secret?string

A whsec_ + base64 secret of 24-64 bytes to sign with, e.g. when migrating from another provider. Generated when omitted.

rate_limit_per_second?integer

At most this many requests per second to this endpoint.

Range1 <= value <= 1000
metadata?

Your own key-value pairs (at most 16; keys up to 40 characters, values up to 500).

enabled?boolean

Response Body

The endpoint and its signing secret.

application/json
  1. response
object*"hook_endpoint"
Value in"hook_endpoint"
id*string
application_id*string
url*string
description*string|null
filter_types*array<string>
rate_limit_per_second*integer|null
enabled*boolean
disabled_reason*|

manual: disabled by you or its user. failing: its deliveries failed every attempt for five days, so COSS disabled it. null while enabled.

Value in"manual""failing"null
disabled_at*|
Formatdate-time
failing_since*|

When its current run of failed deliveries began; cleared by the next success. null while healthy.

Formatdate-time
previous_secret_expires_at*|

After a secret roll, requests are also signed with the previous secret until then.

Formatdate-time
metadata*
created_at*string
Formatdate-time
updated_at*string
Formatdate-time
secret*string

The endpoint's whsec_… signing secret (Standard Webhooks).

import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.hooks.endpoints.create("customer_8812", {  url: "https://example.com/webhooks",  filter_types: [    "invoice.paid",  ],});
{  "object": "hook_endpoint",  "id": "hep_01k7c8m4q2f3e9v6t5r1n0p8yz",  "application_id": "happ_01k7c8m4q2f3e9v6t5r1n0p8yz",  "url": "https://example.com/webhooks",  "description": "Production",  "filter_types": [    "invoice.paid"  ],  "rate_limit_per_second": null,  "enabled": true,  "disabled_reason": null,  "disabled_at": null,  "failing_since": null,  "previous_secret_expires_at": null,  "metadata": {},  "created_at": "2026-01-15T09:30:00.000Z",  "updated_at": "2026-01-15T09:30:00.000Z",  "secret": "whsec_6Jk…"}