> ## Documentation Index
> Fetch the complete documentation index at: https://developers.investorlift.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a seller-side webhook endpoint

> Creates one endpoint for the event types you name.



## OpenAPI

````yaml POST /sell/webhooks
openapi: 3.1.0
info:
  title: Investorlift Marketplace API
  version: '2026-09-18'
  summary: List, publish and trade wholesale real estate deals on Investorlift.
  description: >-
    The Marketplace API gives a seller organization and a buyer account the same
    actions the Investorlift application gives them. A seller creates a draft,
    publishes a deal, reads its leads and answers offers. A buyer searches
    deals, asks for an address, makes an offer and keeps a buy box. Every answer
    carries a request id, and every refusal carries a problem code with one
    recovery sentence.
  contact:
    name: Investorlift support
    email: support@investorlift.com
servers:
  - url: https://api.investorlift.com/marketplace/v1
    description: Production
security:
  - oauth2: []
tags:
  - name: sell
    description: What a seller organization does with its drafts and deals.
  - name: buy
    description: What a buyer account does with deals, offers and buy boxes.
  - name: me
    description: What this token can do right now.
  - name: events
    description: >-
      What Investorlift sends to a webhook endpoint, one entry for each event
      type.
paths:
  /sell/webhooks:
    post:
      tags:
        - sell
      summary: Create a seller-side webhook endpoint
      description: >-
        Creates one endpoint for the event types you name. The API prints the
        signing secret once. The endpoint starts at pending_verification, and
        the API sends a challenge that your endpoint echoes to make it active.
        Your organization holds ten endpoints. Only an owner or an admin of the
        organization runs this operation.
      operationId: createSellWebhook
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          description: >-
            A key of your own that names this attempt. The same key with the
            same body replays the stored answer.
          schema:
            type: string
            minLength: 1
            maxLength: 255
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                  description: An https URL on a public host.
                event_types:
                  minItems: 1
                  type: array
                  items:
                    type: string
                    enum:
                      - deal.published
                      - deal.updated
                      - deal.status_changed
                      - deal.verification_changed
                      - offer.created
                      - offer.countered
                      - offer.accepted
                      - offer.declined
                      - offer.withdrawn
                      - offer.held
                      - inquiry.created
                      - inquiry.held
                      - address_request.created
                      - address_request.approved
                      - address_request.declined
                      - lead.created
                      - lead.status_changed
                      - review.created
                      - client.revoked
                      - webhook.disabled
                      - buyer.redacted
                      - lead.redacted
                  description: The seller-side event types this endpoint takes.
              required:
                - url
                - event_types
              additionalProperties: false
      responses:
        '201':
          description: Created
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/WebhookEndpointWithSecret'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                  - data
                  - meta
                additionalProperties: false
        '400':
          description: Body unusable, Parameter unusable, Parameter unknown
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Problem.invalid_body'
                  - $ref: '#/components/schemas/Problem.invalid_parameter'
                  - $ref: '#/components/schemas/Problem.unknown_parameter'
        '401':
          description: Not authenticated
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem.unauthorized'
        '403':
          description: >-
            Designation missing, Refused, Role too low, Scope missing, No
            organization, Terms not accepted
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Problem.designation_required'
                  - $ref: '#/components/schemas/Problem.forbidden'
                  - $ref: '#/components/schemas/Problem.insufficient_role'
                  - $ref: '#/components/schemas/Problem.insufficient_scope'
                  - $ref: '#/components/schemas/Problem.no_organization'
                  - $ref: '#/components/schemas/Problem.terms_required'
        '405':
          description: Method not allowed
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem.method_not_allowed'
        '409':
          description: >-
            Key reused with a different body, Key in progress, Too many
            endpoints
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Problem.idempotency_conflict'
                  - $ref: '#/components/schemas/Problem.idempotency_in_progress'
                  - $ref: '#/components/schemas/Problem.webhook_limit'
        '422':
          description: Body failed validation, Webhook URL refused
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Problem.validation_failed'
                  - $ref: '#/components/schemas/Problem.webhook_url_refused'
        '503':
          description: Service unavailable
          headers:
            X-Request-Id:
              $ref: '#/components/headers/XRequestId'
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem.origin_error'
      security:
        - oauth2:
            - webhooks:manage
components:
  headers:
    XRequestId:
      description: The id this answer shares with the Investorlift request log.
      schema:
        type: string
  schemas:
    WebhookEndpointWithSecret:
      type: object
      properties:
        id:
          type: string
          description: The endpoint id, whk_<id>.
        url:
          type: string
          description: The https URL each delivery posts to.
        event_types:
          type: array
          items:
            type: string
          description: The event types this endpoint takes.
        api_version:
          type: string
          description: The contract version pinned at create.
        status:
          type: string
          enum:
            - pending_verification
            - active
            - paused
            - disabled
          description: >-
            pending_verification until the endpoint echoes the challenge, then
            active. paused stops delivery. disabled follows three days of
            failure.
        paused_reason:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Why Investorlift paused the endpoint, or null. creator_left says the
            member who created it is no longer an owner or an admin.
            consent_revoked says that member removed the access of the
            application. client_disabled says Investorlift disabled the
            application. An owner or an admin starts it again with status
            active.
        secret_hint:
          type: string
          description: The last four characters of the signing secret.
        created_by:
          type: object
          properties:
            name:
              type: string
              description: The name of the member who created the endpoint.
            email:
              type: string
              description: The email address of that member.
          required:
            - name
            - email
          additionalProperties: false
        client_id:
          type: string
          description: The application that created the endpoint.
        last_delivery:
          anyOf:
            - type: object
              properties:
                event_id:
                  anyOf:
                    - type: string
                    - type: 'null'
                  description: >-
                    The event the attempt carried, as evt_<id>. Null when the
                    record names no event.
                status:
                  type: string
                  enum:
                    - pending
                    - delivered
                    - failed
                  description: What the attempt did.
                attempt:
                  type: integer
                  minimum: -9007199254740991
                  maximum: 9007199254740991
                  description: The try number, starting at one.
                response_code:
                  anyOf:
                    - type: integer
                      minimum: -9007199254740991
                      maximum: 9007199254740991
                    - type: 'null'
                  description: The HTTP status the endpoint answered.
                at:
                  type: string
                  format: date-time
                  pattern: >-
                    ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                  description: When the attempt ran.
              required:
                - event_id
                - status
                - attempt
                - response_code
                - at
              additionalProperties: false
            - type: 'null'
          description: The last attempt, or null.
        failing_since:
          anyOf:
            - type: string
              format: date-time
              pattern: >-
                ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            - type: 'null'
          description: >-
            When the run of failures started, or null while the endpoint
            answers.
        verified_at:
          anyOf:
            - type: string
              format: date-time
              pattern: >-
                ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            - type: 'null'
          description: When the endpoint echoed the challenge.
        created_at:
          type: string
          format: date-time
          pattern: >-
            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
        updated_at:
          type: string
          format: date-time
          pattern: >-
            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
        secret:
          type: string
          description: >-
            The signing secret, whsec_<value>. The API prints it once. Store it
            now.
      required:
        - id
        - url
        - event_types
        - api_version
        - status
        - paused_reason
        - secret_hint
        - created_by
        - client_id
        - last_delivery
        - failing_since
        - verified_at
        - created_at
        - updated_at
        - secret
      additionalProperties: false
    Meta:
      type: object
      properties:
        request_id:
          type: string
          description: The id this answer shares with the log.
        api_version:
          type: string
          description: The contract version the body is rendered at.
      required:
        - request_id
        - api_version
      additionalProperties: false
    Problem.invalid_body:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: Body unusable. Send a JSON body with the content type application/json.
      properties:
        type:
          const: https://developers.investorlift.com/marketplace/errors#invalid_body
        title:
          const: Body unusable
        status:
          const: 400
        code:
          const: invalid_body
        recovery:
          const: Send a JSON body with the content type application/json.
    Problem.invalid_parameter:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Parameter unusable. Correct the query parameter the detail names, then
        repeat the call.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#invalid_parameter
        title:
          const: Parameter unusable
        status:
          const: 400
        code:
          const: invalid_parameter
        recovery:
          const: Correct the query parameter the detail names, then repeat the call.
    Problem.unknown_parameter:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Parameter unknown. Remove the parameter the detail names, because this
        operation reads no such field.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#unknown_parameter
        title:
          const: Parameter unknown
        status:
          const: 400
        code:
          const: unknown_parameter
        recovery:
          const: >-
            Remove the parameter the detail names, because this operation reads
            no such field.
        unknown_parameters:
          type: array
          items:
            type: string
          description: Every field of the request this operation does not read.
      required:
        - unknown_parameters
    Problem.unauthorized:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Not authenticated. Send a current access token for this API, and start a
        new authorization when the token is expired.
      properties:
        type:
          const: https://developers.investorlift.com/marketplace/errors#unauthorized
        title:
          const: Not authenticated
        status:
          const: 401
        code:
          const: unauthorized
        recovery:
          const: >-
            Send a current access token for this API, and start a new
            authorization when the token is expired.
    Problem.designation_required:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Designation missing. Finish the onboarding of the side you call, then
        repeat the call.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#designation_required
        title:
          const: Designation missing
        status:
          const: 403
        code:
          const: designation_required
        recovery:
          const: Finish the onboarding of the side you call, then repeat the call.
        designation:
          description: The designation the side of this operation needs.
          type: string
          enum:
            - seller
            - buyer
    Problem.forbidden:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Refused. Ask Investorlift support why the account, the client or the
        organization is stopped.
      properties:
        type:
          const: https://developers.investorlift.com/marketplace/errors#forbidden
        title:
          const: Refused
        status:
          const: 403
        code:
          const: forbidden
        recovery:
          const: >-
            Ask Investorlift support why the account, the client or the
            organization is stopped.
    Problem.insufficient_role:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Role too low. Ask an owner or an admin of the organization to run this
        call, or to raise your role.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#insufficient_role
        title:
          const: Role too low
        status:
          const: 403
        code:
          const: insufficient_role
        recovery:
          const: >-
            Ask an owner or an admin of the organization to run this call, or to
            raise your role.
        role:
          anyOf:
            - type: string
              enum:
                - member
                - admin
                - owner
            - type: 'null'
          description: >-
            The role the caller holds in the organization today, or null for
            none.
        required_roles:
          type: array
          items:
            type: string
            enum:
              - owner
              - admin
          description: The roles that run this operation.
      required:
        - role
        - required_roles
    Problem.insufficient_scope:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Scope missing. Start a new authorization that asks for the scope named
        in the detail.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#insufficient_scope
        title:
          const: Scope missing
        status:
          const: 403
        code:
          const: insufficient_scope
        recovery:
          const: >-
            Start a new authorization that asks for the scope named in the
            detail.
        scope:
          type: string
          enum:
            - marketplace:profile
            - deals:read
            - deals:write
            - offers:read
            - offers:write
            - inquiries:read
            - inquiries:write
            - leads:read
            - leads:write
            - contacts:read
            - reviews:read
            - buy_boxes:manage
            - webhooks:manage
            - events:read
          description: The scope this operation needs.
      required:
        - scope
    Problem.no_organization:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        No organization. Create an organization on Investorlift, then repeat the
        call.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#no_organization
        title:
          const: No organization
        status:
          const: 403
        code:
          const: no_organization
        recovery:
          const: Create an organization on Investorlift, then repeat the call.
    Problem.terms_required:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Terms not accepted. Accept the Marketplace API Terms on the consent
        page, then start a new authorization.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#terms_required
        title:
          const: Terms not accepted
        status:
          const: 403
        code:
          const: terms_required
        recovery:
          const: >-
            Accept the Marketplace API Terms on the consent page, then start a
            new authorization.
        agreement_id:
          type: string
          description: The version of the Marketplace API Terms to accept.
      required:
        - agreement_id
    Problem.method_not_allowed:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Method not allowed. Use one of the methods the documentation lists for
        this path.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#method_not_allowed
        title:
          const: Method not allowed
        status:
          const: 405
        code:
          const: method_not_allowed
        recovery:
          const: Use one of the methods the documentation lists for this path.
    Problem.idempotency_conflict:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Key reused with a different body. Send a new Idempotency-Key for this
        body, because the stored key holds another one.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#idempotency_conflict
        title:
          const: Key reused with a different body
        status:
          const: 409
        code:
          const: idempotency_conflict
        recovery:
          const: >-
            Send a new Idempotency-Key for this body, because the stored key
            holds another one.
    Problem.idempotency_in_progress:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Key in progress. Wait one second, then repeat the call with the same
        Idempotency-Key.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#idempotency_in_progress
        title:
          const: Key in progress
        status:
          const: 409
        code:
          const: idempotency_in_progress
        recovery:
          const: Wait one second, then repeat the call with the same Idempotency-Key.
    Problem.webhook_limit:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Too many endpoints. Delete an endpoint of this side, then create the new
        one.
      properties:
        type:
          const: https://developers.investorlift.com/marketplace/errors#webhook_limit
        title:
          const: Too many endpoints
        status:
          const: 409
        code:
          const: webhook_limit
        recovery:
          const: Delete an endpoint of this side, then create the new one.
    Problem.validation_failed:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Body failed validation. Correct each field the detail names, then repeat
        the call.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#validation_failed
        title:
          const: Body failed validation
        status:
          const: 422
        code:
          const: validation_failed
        recovery:
          const: Correct each field the detail names, then repeat the call.
    Problem.webhook_url_refused:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Webhook URL refused. Send an https URL on a public host, because a
        private address takes no delivery.
      properties:
        type:
          const: >-
            https://developers.investorlift.com/marketplace/errors#webhook_url_refused
        title:
          const: Webhook URL refused
        status:
          const: 422
        code:
          const: webhook_url_refused
        recovery:
          const: >-
            Send an https URL on a public host, because a private address takes
            no delivery.
    Problem.origin_error:
      allOf:
        - $ref: '#/components/schemas/Problem'
      description: >-
        Service unavailable. Repeat the call in a minute, and tell Investorlift
        support when the answer stays the same.
      properties:
        type:
          const: https://developers.investorlift.com/marketplace/errors#origin_error
        title:
          const: Service unavailable
        status:
          const: 503
        code:
          const: origin_error
        recovery:
          const: >-
            Repeat the call in a minute, and tell Investorlift support when the
            answer stays the same.
    Problem:
      type: object
      description: >-
        One refusal, as RFC 9457 application/problem+json. The code picks the
        status, the title and the recovery sentence.
      properties:
        type:
          type: string
          format: uri
          description: The errors page anchor of the code.
        title:
          type: string
          description: The short title of the code.
        status:
          type: integer
          description: The HTTP status of this answer.
        code:
          type: string
          enum:
            - address_unavailable
            - agreement_required
            - api_offers_disabled
            - below_floor
            - cap_reached
            - client_limit
            - daily_cap_reached
            - deal_changed
            - deal_closed
            - deal_incomplete
            - designation_required
            - draft_under_review
            - duplicate_inquiry
            - forbidden
            - idempotency_conflict
            - idempotency_in_progress
            - idv_required
            - insufficient_balance
            - insufficient_role
            - insufficient_scope
            - invalid_body
            - invalid_id
            - invalid_parameter
            - invalid_transition
            - lead_locked
            - method_not_allowed
            - no_organization
            - not_a_member
            - not_found
            - offer_exists
            - offer_required
            - offer_superseded
            - organization_required
            - origin_error
            - person_exists
            - preview_expired
            - preview_mismatch
            - proof_of_funds_expired
            - proof_of_funds_missing
            - rate_limited
            - requirement_unmet
            - resource_exists
            - resource_limit
            - strike_exists
            - strike_window_closed
            - terms_required
            - unauthorized
            - unknown_parameter
            - validation_failed
            - webhook_limit
            - webhook_url_refused
            - wrong_side
          description: The problem code. Read this, never the title.
        detail:
          type: string
          description: What happened for this one request.
        recovery:
          type: string
          description: One sentence that says what to do next.
        request_id:
          type: string
          description: The id this answer shares with the log.
      required:
        - type
        - title
        - status
        - code
        - detail
        - recovery
        - request_id
  securitySchemes:
    oauth2:
      type: oauth2
      description: >-
        Authorization code with PKCE. The person grants the scopes on the
        Investorlift consent page and accepts the Marketplace API Terms there.
      flows:
        authorizationCode:
          authorizationUrl: https://mogul.investorlift.com/api/auth/oauth2/authorize
          tokenUrl: https://mogul.investorlift.com/api/auth/oauth2/token
          refreshUrl: https://mogul.investorlift.com/api/auth/oauth2/token
          scopes:
            marketplace:profile: Read your account, your organization and your trust tier.
            deals:read: Read your deals as a seller, and the deals you see as a buyer.
            deals:write: >-
              Create drafts, add media and documents, publish deals and change
              their status.
            offers:read: >-
              Read the offers on your deals as a seller, and your own offers as
              a buyer.
            offers:write: Make, counter, accept, decline and withdraw offers.
            inquiries:read: >-
              Read the inquiries and address requests on your deals, and your
              own.
            inquiries:write: Send inquiries and address requests, and answer address requests.
            leads:read: Read the leads on your deals with their history.
            leads:write: Set a lead status, add a lead and file a strike.
            contacts:read: >-
              Read the email address and the phone number of a buyer on your
              deals.
            reviews:read: Read a seller public profile and the reviews of that seller.
            buy_boxes:manage: Read and change your buy boxes and their alerts.
            webhooks:manage: Create, read and delete the webhook endpoints of your side.
            events:read: Read the event feed of your side.

````

## Related topics

- [Create a seller-side webhook endpoint](/api-reference/sell/create-a-seller-side-webhook-endpoint.md)
- [Create a buy-side webhook endpoint](/marketplace/reference/create-buy-webhook.md)
- [List the seller-side webhook endpoints](/marketplace/reference/list-sell-webhooks.md)