> ## Documentation Index > Fetch the complete documentation index at: https://docs.bullionwale.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a webhook > **Not yet available.** Webhooks are implemented but switched off: these endpoints answer `404` until Bullionwale turns them on. **Test** (`/api/trading/test/v1`): **Available on request.** Ask the Bullionwale desk to turn on API access for your account and issue a test key. Test orders are simulated; nothing is booked. **Production** (`/api/trading/v1`): **Switched off.** Production trading is implemented but not available: orders are refused with `403 production_trading_disabled`. Once it opens, Bullionwale enables production access per account (see Production access requirements). Register an HTTPS endpoint for this environment's events. The response carries the signing secret, the only time it is shown. ## OpenAPI ````yaml /openapi.json post /webhooks openapi: 3.1.0 info: description: >- Place and read bullion orders with an API key. The test environment (`/api/trading/test/v1`) simulates orders; the production environment (`/api/trading/v1`) books real orders. **Test: available on request. Production: switched off.** See the availability notice in the documentation. title: Bullionwale API version: 1.0.0 servers: - description: Test url: https://api.bullionwale.com/api/trading/test/v1 - description: Production url: https://api.bullionwale.com/api/trading/v1 security: [] tags: - description: >- The account and API key behind a request, the key's scopes, and whether production trading is available to the account. name: Account - description: >- Your live Buy and Sell rates per symbol, with freshness and trading flags. The same prices on test and production. name: Market data - description: >- The symbols you can trade: metal, price and quantity units, the sizes you may order and which sides are offered. name: Symbols - description: >- Whether trading is halted, which symbols are frozen, the market clock and your rates at the latest official close. name: Market status - description: >- Your weight allocation per metal and how much of it your open position uses. name: Trading limits - description: >- Realized profit and loss from your closed orders, in total, per symbol and per day. name: Profit & loss - description: >- Place market orders, list them and read one. Test orders are simulated; production orders are real. name: Orders - description: >- Place a buy or sell limit that waits for a price, list your limits, read, edit and cancel one. Test limits are simulated and never execute; production limits are real. name: Limit orders - description: Your net position per metal against your weight allocation. name: Positions - description: Your physical-delivery requests and their status. name: Deliveries - description: >- Your API keys in the calling environment: ids, names, scopes, state. Never a secret. name: API keys - description: >- Register HTTPS endpoints that receive signed order and limit-order events, test them and rotate their signing secret. Not yet available. name: Webhooks paths: /webhooks: post: tags: - Webhooks summary: Create a webhook description: >- **Not yet available.** Webhooks are implemented but switched off: these endpoints answer `404` until Bullionwale turns them on. **Test** (`/api/trading/test/v1`): **Available on request.** Ask the Bullionwale desk to turn on API access for your account and issue a test key. Test orders are simulated; nothing is booked. **Production** (`/api/trading/v1`): **Switched off.** Production trading is implemented but not available: orders are refused with `403 production_trading_disabled`. Once it opens, Bullionwale enables production access per account (see Production access requirements). Register an HTTPS endpoint for this environment's events. The response carries the signing secret, the only time it is shown. operationId: post_webhooks requestBody: content: application/json: schema: $ref: '#/components/schemas/WebhookIn' required: true responses: '201': content: application/json: examples: production_created: summary: Created value: active: true created_at: '2026-10-21T09:30:00+00:00' description: Order bot environment: production events: - order.booked - order.closed id: 5b0e8f2c-7a41-4d7e-9c3a-2f6d1e8b4a90 secret: whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx secret_last4: Qx3k updated_at: '2026-10-21T09:30:00+00:00' url: https://hooks.example.com/bullionwale test_created: summary: Created value: active: true created_at: '2026-10-21T09:30:00+00:00' description: Order bot environment: test events: - order.booked - order.closed id: 5b0e8f2c-7a41-4d7e-9c3a-2f6d1e8b4a90 secret: whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx secret_last4: Qx3k updated_at: '2026-10-21T09:30:00+00:00' url: https://hooks.example.com/bullionwale schema: $ref: '#/components/schemas/WebhookWithSecret' description: Successful Response '401': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `missing_credential`: No X-API-Key header. `malformed_credential`: The key is not shaped like an API key. `wrong_tenant`: The key belongs to a different broker. `wrong_environment`: A test key on the production API, or the reverse. `invalid_credential`: Unknown key or wrong secret. `credential_revoked`: The key was revoked. `credential_rotated`: The key was replaced and its overlap period ended. `credential_expired`: The key expired. '403': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: |- `api_access_disabled`: API access is switched off for this account. `account_inactive`: The account is not active. `insufficient_scope`: The key lacks the scope this route needs. '409': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `webhook_limit_reached`: The account already has the maximum number of webhooks in this environment. '422': content: application/json: examples: invalid_webhook_url: summary: Not https, or not a public address value: detail: code: invalid_webhook_url message: The webhook URL must use https. schema: $ref: '#/components/schemas/ApiError' description: >- `invalid_request`: The request body or parameters are invalid; see `detail.errors`. `invalid_webhook_url`: The URL is not https, carries credentials or a fragment, does not resolve, or points at a non-public address. `invalid_event_type`: `events` is empty or names an unknown event type. '429': content: application/json: schema: $ref: '#/components/schemas/ApiError' description: >- `auth_throttled`: Too many failed authentications from this address; see Retry-After. `rate_limited`: This key (or, for orders, this account) exhausted its budget; see Retry-After. security: - ApiKeyAuth: [] components: schemas: WebhookIn: properties: description: anyOf: - maxLength: 255 type: string - type: 'null' title: Description events: description: Event types to receive. items: type: string maxItems: 20 title: Events type: array url: description: An `https://` URL on the public internet. maxLength: 2048 title: Url type: string required: - url - events title: WebhookIn type: object WebhookWithSecret: properties: active: title: Active type: boolean created_at: anyOf: - type: string - type: 'null' title: Created At description: anyOf: - type: string - type: 'null' title: Description environment: description: '`test` or `production`: the events it receives.' title: Environment type: string events: items: type: string title: Events type: array id: title: Id type: string secret: description: >- The signing secret (`whsec_...`). Shown only in this response: store it now. title: Secret type: string secret_last4: description: The last 4 characters of the signing secret. title: Secret Last4 type: string updated_at: anyOf: - type: string - type: 'null' title: Updated At url: title: Url type: string required: - id - environment - url - events - active - secret_last4 - secret title: WebhookWithSecret type: object ApiError: description: Every refusal on the trading API. properties: detail: $ref: '#/components/schemas/ApiErrorDetail' required: - detail title: ApiError type: object ApiErrorDetail: additionalProperties: true properties: code: description: Stable machine code; branch on this, not on `message`. title: Code type: string message: description: Human-readable text; may change. title: Message type: string required: - code - message title: ApiErrorDetail type: object securitySchemes: ApiKeyAuth: in: header name: X-API-Key type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.