API · Platform · Webhooks
Create a webhook endpoint.
Subscribe an HTTPS URL to receive event deliveries. Webhook endpoints are how Matter pushes asynchronous outcomes back to the caller — formation-complete, filing-accepted, grant-issued, mail-received — so callers never have to poll.
Each delivery is signed with HMAC-SHA256 using a per-endpoint secret returned exactly once at creation in the secret field. Verify every payload server-side using the Matter-Signature: t=<unix>,v1=<hex> header (timestamp + HMAC of the body). Per-entity event ordering is strict: events for a given entity_id arrive in the sequence they occurred, with monotonic sequence integers.
Key fields - enabled_events — the event types this endpoint wants. Use ["*"] to receive all events; whitelist specific ones for a tight scope (["entity.state_changed", "filing.accepted"]). - api_version — pins the payload shape to a dated API version. The endpoint receives that version's serialization regardless of the active platform default, so a model rev does not silently change wire format. - include — opt into "fat" deliveries that embed the full target resource (default deliveries are "thin" — id-only, fetch the resource yourself). Fat saves a round-trip; thin saves bandwidth and avoids stale snapshots in payloads.
Returns 200 OK with the endpoint resource and the plaintext secret that must be persisted by the caller — Matter only stores its hash. Idempotent via Idempotency-Key. See idempotency.
See also: Webhooks API overview, Cookbook: form a company.
Last updated
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
urlstring<uri>RequireddescriptionstringOptionalenabled_eventsarray<string>Requiredapi_versionstring<date>Requiredincludearray<string>Optionalportfolio_idstringOptionalScope this endpoint to one portfolio. When set, the
endpoint receives ONLY events stamped with this
portfolio (every event payload carries portfolio_id);
omit for an org-wide endpoint that receives everything.
A platform points one scoped endpoint per end customer
to demux its firehose. Must reference a portfolio in the
caller's account; unknown ids return 404.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
Request
curl -X POST "https://api.mattermode.com/v1/webhook_endpoints" \ -H "Content-Type: application/json" \ -d '{ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i" }'const body = JSON.stringify({ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i"})fetch("https://api.mattermode.com/v1/webhook_endpoints", { method: "POST", headers: { "Content-Type": "application/json" }, body})package mainimport ( "fmt" "net/http" "io/ioutil" "strings")func main() { url := "https://api.mattermode.com/v1/webhook_endpoints" body := strings.NewReader(`{ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i" }`) req, _ := http.NewRequest("POST", url, body) req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := ioutil.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body))}import requestsheaders = { "Authorization": "Bearer sk_test_4eC39HqLyjWDarjtT1zdp7dc", "Matter-Version": "2026-06-10", "Idempotency-Key": "ee7c3a9b-3f1a-4d8e-9b2a-7c5e1f0a2d4b",}payload = { "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i"}resp = requests.post( "https://api.mattermode.com/v1/webhook_endpoints", headers=headers, json=payload,)resp.raise_for_status()print(resp.json())import java.net.URI;import java.net.http.HttpClient;import java.net.http.HttpRequest;import java.net.http.HttpResponse;import java.net.http.HttpResponse.BodyHandlers;import java.time.Duration;import java.net.http.HttpRequest.BodyPublishers;var body = BodyPublishers.ofString("""{ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i"}""");HttpClient client = HttpClient.newBuilder() .connectTimeout(Duration.ofSeconds(10)) .build();HttpRequest.Builder requestBuilder = HttpRequest.newBuilder() .uri(URI.create("https://api.mattermode.com/v1/webhook_endpoints")) .header("Content-Type", "application/json") .POST(body) .build();try { HttpResponse<String> response = client.send(requestBuilder.build(), BodyHandlers.ofString()); System.out.println("Status code: " + response.statusCode()); System.out.println("Response body: " + response.body());} catch (Exception e) { e.printStackTrace();}using System;using System.Net.Http;using System.Text;var body = new StringContent("""{ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i"}""", Encoding.UTF8, "application/json");var client = new HttpClient();var response = await client.PostAsync("https://api.mattermode.com/v1/webhook_endpoints", body);var responseBody = await response.Content.ReadAsStringAsync();curl --request POST 'https://api.mattermode.com/v1/webhook_endpoints' \ --header 'Authorization: Bearer sk_test_4eC39HqLyjWDarjtT1zdp7dc' \ --header 'Matter-Version: 2026-06-10' \ --header 'Idempotency-Key: ee7c3a9b-3f1a-4d8e-9b2a-7c5e1f0a2d4b' \ --header 'Content-Type: application/json' \ --data '{ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i"}'const response = await fetch("https://api.mattermode.com/v1/webhook_endpoints", { method: "POST", headers: { "Authorization": "Bearer sk_test_4eC39HqLyjWDarjtT1zdp7dc", "Matter-Version": "2026-06-10", "Idempotency-Key": "ee7c3a9b-3f1a-4d8e-9b2a-7c5e1f0a2d4b", "Content-Type": "application/json", }, body: JSON.stringify({ "url": "https://your.app/webhooks/matter", "description": "string", "enabled_events": [ "string" ], "api_version": "2026-04-25", "include": [ "data.object" ], "portfolio_id": "pf_studio_fund_i" }),});if (!response.ok) { throw new Error(`Matter API ${response.status}: ${await response.text()}`);}const data = await response.json();console.log(data);Response
application/json{
"id": "string",
"object": "webhook_endpoint",
"url": "https://your.app/webhooks/matter",
"description": "string",
"enabled_events": [
"string"
],
"api_version": "2026-04-25",
"include": [
"data.object"
],
"signing_secret": "string",
"status": "enabled",
"last_delivery": {},
"metadata": {},
"created": 1745539200,
"updated": 1745539200,
"livemode": false
}{
"type": "https://mattermode.com/docs/errors/invalid_request",
"title": "Invalid request",
"status": 400,
"code": "invalid_request",
"detail": "Request body could not be parsed as JSON.",
"doc_url": "https://mattermode.com/docs/guides/errors#invalid_request",
"request_id": "req_Qw9xYz8A"
}{
"type": "https://mattermode.com/docs/errors/authentication_required",
"title": "Authentication required",
"status": 401,
"code": "authentication_required",
"detail": "No bearer token was supplied. Pass `Authorization: Bearer sk_live_...` on every request.",
"doc_url": "https://mattermode.com/docs/guides/errors#authentication_required",
"request_id": "req_Qw9xYz8A"
}{
"type": "https://mattermode.com/docs/errors/rate_limit_exceeded",
"title": "Rate limit exceeded",
"status": 429,
"code": "rate_limit_exceeded",
"detail": "Request rate exceeded for this key. Retry after `retry_after` seconds or honor the `Retry-After` header.",
"doc_url": "https://mattermode.com/docs/guides/errors#rate_limit_exceeded",
"request_id": "req_Qw9xYz8A",
"retry_after": 30
}