> ## Documentation Index > Fetch the complete documentation index at: https://docs.zebratruth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Register a webhook endpoint > **Dashboard session only**, owner role, with a recent-authentication proof (`X-Recent-Auth-Proof`) and an `Idempotency-Key`. Returns the signing secret exactly once. Deliveries carry `X-ZebraTruth-Signature` (`sha256=` HMAC-SHA256 of the raw body with this secret), `X-ZebraTruth-Timestamp` and `X-ZebraTruth-Event-Id`; retries reuse all three, so de-duplicate on the event id. ## OpenAPI ````yaml /openapi/zebratruth-v1.yaml post /webhooks openapi: 3.1.0 info: title: ZebraTruth Compliance API version: 1.0.0 description: > AI-powered compliance checking for advertising content. Check text and images against jurisdiction laws, platform policies, and rights clearance requirements. Results include embeddable annotations mapped to content locations (text spans, video timestamps, image regions). contact: name: ZebraTruth Support email: support@zebratruth.ai url: https://developers.zebratruth.ai license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.zebratruth.ai/v1 description: Production security: - bearerAuth: [] tags: - name: Video Compliance description: > **Primary endpoint.** Async compliance analysis for video ads. 3-step flow: get an upload URL, upload the video bytes, submit for analysis. Poll or receive an HMAC-signed webhook with the report. Returns timestamped findings citing stable evidence IDs (`audio_NNN`, `frame_NNN`, `ocr_NNN`, `signal_NNN`). 3-180 second videos. mp4 / webm / quicktime. Built for ad agencies and creators. - name: Authentication description: Validate API keys and check account status - name: Compliance description: >- Run compliance checks on text + image content (sync). For video, use the Video Compliance endpoints above. - name: Agents description: Discover and invoke individual compliance agents - name: Jobs description: Poll async job status and view execution traces - name: Reports description: Retrieve and replay compliance reports - name: Observability description: Request logs and webhook delivery status - name: Billing description: Subscriptions, plan changes, and credit balance - name: Documents description: Extract text from PDF and Word documents before or as part of a check - name: Check History description: List and retrieve past compliance checks for the workspace - name: Provenance description: Inspect and sign Content Credentials (C2PA) on images and video - name: Corpus description: >- Review queue for proposed changes to the governed legal corpus (dashboard session) - name: Webhooks description: Saved webhook endpoints (dashboard session) and delivery logs paths: /webhooks: post: tags: - Webhooks summary: Register a webhook endpoint description: > **Dashboard session only**, owner role, with a recent-authentication proof (`X-Recent-Auth-Proof`) and an `Idempotency-Key`. Returns the signing secret exactly once. Deliveries carry `X-ZebraTruth-Signature` (`sha256=` HMAC-SHA256 of the raw body with this secret), `X-ZebraTruth-Timestamp` and `X-ZebraTruth-Event-Id`; retries reuse all three, so de-duplicate on the event id. operationId: registerWebhook parameters: - $ref: '#/components/parameters/IdempotencyKey' - name: X-Recent-Auth-Proof in: header required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WebhookRegisterRequest' responses: '200': description: Endpoint registered content: application/json: schema: $ref: '#/components/schemas/WebhookRegisterResponse' '400': description: >- `data.code`: `invalid_url`, `url_not_allowed`, `idempotency_key_required`, `recent_auth_action_mismatch`; or a validation message without a code. content: application/json: schema: $ref: '#/components/schemas/CodedError' '401': description: >- `data.code`: `proof_invalid`, `access_principal_required`, `recent_auth_required`. content: application/json: schema: $ref: '#/components/schemas/CodedError' '403': $ref: '#/components/responses/ForbiddenCoded' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: true schema: type: string format: uuid description: > Unique request identifier to prevent duplicate execution and double-charging. Generate a new UUID for each distinct request. Reuse the same key to safely retry. schemas: WebhookRegisterRequest: type: object required: - url properties: url: type: string format: uri description: > HTTPS endpoint. Rejected with 400 `invalid_url` (bad URL, wrong protocol, embedded credentials, fragment) or `url_not_allowed` (disallowed, unresolvable, or private address). events: type: array minItems: 1 items: type: string default: - check.completed - check.failed description: Event names to deliver. `*` subscribes to every event. WebhookRegisterResponse: type: object properties: webhookId: type: string secret: type: string description: Shown once, here only. Verify `X-ZebraTruth-Signature` with it. example: whsec_0123456789abcdef0123456789abcdef url: type: string format: uri events: type: array items: type: string message: type: string CodedError: type: object description: > Standard error envelope. `data.code` is the stable discriminator to branch on; `statusMessage` is the human-readable reason. Unless a response documents extra named fields, `data` is reduced to `{ code }` before it is sent. required: - statusCode - message properties: error: type: boolean example: true url: type: string format: uri statusCode: type: integer statusMessage: type: string message: type: string data: type: object required: - code properties: code: type: string example: review_scope_not_enabled additionalProperties: true responses: ForbiddenCoded: description: > The credential is valid but may not perform this action. `data.code` is one of `permission_not_granted`, `principal_forbidden_control_plane` (an API key called a dashboard-only action), `membership_not_active`, `entitlement_required`, `workspace_provisioning`, `workspace_deletion_scheduled`. content: application/json: schema: $ref: '#/components/schemas/CodedError' securitySchemes: bearerAuth: type: http scheme: bearer description: | API key starting with `zt_live_` (production) or `zt_test_` (sandbox). Get your key at https://developers.zebratruth.ai ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.