> ## Documentation Index > Fetch the complete documentation index at: https://docs.bullionwale.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook (production) > **Switched off.** Production trading is implemented but not available: orders are refused with `403 production_trading_disabled`. Once it opens, Bullionwale enables production access per account (see Production access requirements). **Not yet available.** Webhooks are implemented but switched off: these endpoints answer `404` until Bullionwale turns them on. Register an HTTPS endpoint for this environment's events. The response carries the signing secret, the only time it is shown. ## OpenAPI ````yaml /openapi.json post /api/trading/v1/webhooks openapi: 3.1.0 info: description: >- Place and read bullion orders with an API key. The test environment (`/api/trading/test/v1`) simulates orders; the production environment (`/api/trading/v1`) books real orders. **Test: available on request. Production: switched off.** See the availability notice in the documentation. title: Bullionwale API version: 1.0.0 servers: - description: Once the API is available url: https://api.bullionwale.com security: [] tags: - description: >- The account and API key behind a request, the key's scopes, and whether production trading is available to the account. name: Account - description: >- Your live Buy and Sell rates per symbol, with freshness and trading flags. The same prices on test and production. name: Market data - description: >- The symbols you can trade: metal, price and quantity units, the sizes you may order and which sides are offered. name: Symbols - description: >- Whether trading is halted, which symbols are frozen, the market clock and your rates at the latest official close. name: Market status - description: >- Your weight allocation per metal and how much of it your open position uses. name: Trading limits - description: >- Realized profit and loss from your closed orders, in total, per symbol and per day. name: Profit & loss - description: >- Place market orders, list them and read one. Test orders are simulated; production orders are real. name: Orders - description: >- Place a buy or sell limit that waits for a price, list your limits, read, edit and cancel one. Test limits are simulated and never execute; production limits are real. name: Limit orders - description: Your net position per metal against your weight allocation. name: Positions - description: Your physical-delivery requests and their status. name: Deliveries - description: >- Your API keys in the calling environment: ids, names, scopes, state. Never a secret. name: API keys - description: >- Register HTTPS endpoints that receive signed order and limit-order events, test them and rotate their signing secret. Not yet available. name: Webhooks paths: /api/trading/v1/webhooks: post: tags: - Webhooks summary: Create a webhook (production) description: >- **Switched off.** Production trading is implemented but not available: orders are refused with `403 production_trading_disabled`. Once it opens, Bullionwale enables production access per account (see Production access requirements). **Not yet available.** Webhooks are implemented but switched off: these endpoints answer `404` until Bullionwale turns them on. Register an HTTPS endpoint for this environment's events. The response carries the signing secret, the only time it is shown. operationId: create_webhook_production_api_trading_v1_webhooks_post requestBody: content: application/json: schema: $ref: '#/components/schemas/WebhookIn' required: true responses: '201': content: application/json: examples: created: summary: Created value: active: true created_at: '2026-10-21T09:30:00+00:00' description: Order bot environment: production events: - order.booked - order.closed id: 5b0e8f2c-7a41-4d7e-9c3a-2f6d1e8b4a90 secret: whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx secret_last4: Qx3k updated_at: '2026-10-21T09:30:00+00:00' url: https://hooks.example.com/bullionwale schema: $ref: '#/components/schemas/WebhookWithSecret' description: Successful Response '401': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `missing_credential`: No X-API-Key header. `malformed_credential`: The key is not shaped like an API key. `wrong_tenant`: The key belongs to a different broker. `wrong_environment`: A test key on the production API, or the reverse. `invalid_credential`: Unknown key or wrong secret. `credential_revoked`: The key was revoked. `credential_rotated`: The key was replaced and its overlap period ended. `credential_expired`: The key expired. '403': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: |- `api_access_disabled`: API access is switched off for this account. `account_inactive`: The account is not active. `insufficient_scope`: The key lacks the scope this route needs. '409': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `webhook_limit_reached`: The account already has the maximum number of webhooks in this environment. '422': content: application/json: examples: invalid_webhook_url: summary: Not https, or not a public address value: detail: code: invalid_webhook_url message: The webhook URL must use https. schema: $ref: '#/components/schemas/ApiError' description: >- `invalid_request`: The request body or parameters are invalid; see `detail.errors`. `invalid_webhook_url`: The URL is not https, carries credentials or a fragment, does not resolve, or points at a non-public address. `invalid_event_type`: `events` is empty or names an unknown event type. '429': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `auth_throttled`: Too many failed authentications from this address; see Retry-After. `rate_limited`: This key (or, for orders, this account) exhausted its budget; see Retry-After. security: - ApiKeyAuth: [] components: schemas: WebhookIn: properties: description: anyOf: - maxLength: 255 type: string - type: 'null' title: Description events: description: Event types to receive. items: type: string maxItems: 20 title: Events type: array url: description: An `https://` URL on the public internet. maxLength: 2048 title: Url type: string required: - url - events title: WebhookIn type: object WebhookWithSecret: properties: active: title: Active type: boolean created_at: anyOf: - type: string - type: 'null' title: Created At description: anyOf: - type: string - type: 'null' title: Description environment: description: '`test` or `production`: the events it receives.' title: Environment type: string events: items: type: string title: Events type: array id: title: Id type: string secret: description: >- The signing secret (`whsec_...`). Shown only in this response: store it now. title: Secret type: string secret_last4: description: The last 4 characters of the signing secret. title: Secret Last4 type: string updated_at: anyOf: - type: string - type: 'null' title: Updated At url: title: Url type: string required: - id - environment - url - events - active - secret_last4 - secret title: WebhookWithSecret type: object ApiError: description: Every refusal on the trading API. properties: detail: $ref: '#/components/schemas/ApiErrorDetail' required: - detail title: ApiError type: object ApiErrorDetail: additionalProperties: true properties: code: description: Stable machine code; branch on this, not on `message`. title: Code type: string message: description: Human-readable text; may change. title: Message type: string required: - code - message title: ApiErrorDetail type: object securitySchemes: ApiKeyAuth: in: header name: X-API-Key type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.