# WebhookSaveRequest

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/http-api/schemas/webhooksaverequest/
> Summary: OpenAPI request or response schema for WebhookSaveRequest, including required fields, defaults, constraints, and linked nested types.

[← All HTTP schemas](/http-api/schemas/)

The request body for saving a webhook subscription.

**Shape:** `object`

| Property | Required | Type | Description | Rules |
|---|---|---|---|---|
| `url` | no | `string` | The address events are sent to. Only `https` (or loopback `http`). | — |
| `events` | no | `array` | The names of the subscribed events. See WebhookEvents. | — |
| `secretConfigurationKey` | no | `string` | The <strong>name</strong> of the configuration key from which the signing secret is read. Not the secret itself. | — |
| `headers` | no | `object` | Additional headers to add to every request. The values are stored as plain text, so a header whose name looks like a credential (`Authorization`, `X-Api-Key`, `Cookie`, any name ending in `-key`) is rejected with `400`: declare it in `HeaderConfigurationKeys`. Send every header with its real value on each save: a response masks the values as `***`, and a value of `***` is rejected with `400`. Absent or `null` keeps the stored headers; `{}` removes them. | — |
| `headerConfigurationKeys` | no | `object` | Credential headers, as a map from the header name to the NAME of the configuration key its value is read from, for example `{"X-Api-Key": "Tracon:WebhookSecrets:acme:OrdersKey"}`. Every name must sit inside the caller's tenant key space. A response returns the map unmasked: it carries no value. Absent or `null` keeps the stored map; `{}` removes it. | — |
| `enabled` | no | `boolean` | Whether the subscription is enabled. | — |