Create a Twitter Webhook Endpoint API

Register an HTTPS destination for real-time X/Twitter tweet delivery and receive its HMAC signing secret, which is shown once and never returned again.

POST/twitter/monitor/webhook/create

One webhook can serve many monitors, so create one per destination, not one per account you watch.

Headers

Header	Type	Required	Description
`Authorization`	string	Yes	`Bearer YOUR_API_KEY`, the same key used for every other GetXAPI endpoint
`Content-Type`	string	Yes	`application/json`

Request Body

Field	Type	Required	Description
`url`	string	Yes	Where deliveries are sent. Must be HTTPS and resolve to a public address.

Notes

The URL must be HTTPS. Plain HTTP is rejected.
It must resolve to a public address. Loopback, private, and link-local ranges are refused. localhost, 127.0.0.1, and 10.x / 192.168.x addresses will not be accepted. Use a tunnel (ngrok, Cloudflare Tunnel) while developing.
The returned signing_secret is shown once and cannot be retrieved afterwards. Store it before you make another request.
Creating a webhook doesn't start any monitoring on its own. Attach it to a monitor with Add monitor.

Response (200)

{
  "webhook_id": "8f14e45f-ceea-467a-9f2b-1c3d4e5f6a7b",
  "url": "https://your-server.com/hooks/getxapi",
  "status": "active",
  "signing_secret": "whsec_9f2b1c3d4e5f6a7b8c9d0e1f2a3b4c5d",
  "note": "Store this secret now. It is shown only once."
}

Save signing_secret immediately. It is encrypted at rest and never returned again, not by List webhooks and not by any other endpoint. If you lose it, delete the webhook and create a new one, then repoint your monitors.

Storing the signing secret securely

The secret is the only thing standing between your endpoint and a forged request, so treat it like a database password rather than a config value:

Keep it in an environment variable or a secret manager, never in source control and never in client-side code.
Give each environment its own webhook, so a leaked staging secret cannot be used to forge production traffic.
To rotate it, create a second webhook, repoint your monitors with Update monitor, then delete the old one. There is no in-place rotation, because the secret is never retrievable after creation.
If you lose it, you cannot recover it. Delete the webhook and create a new one.

Response Fields

Field	Type	Description
`webhook_id`	string	UUID used to attach monitors to this webhook
`url`	string	The registered destination
`status`	string	`active`
`signing_secret`	string	HMAC key for verifying deliveries. Shown once.
`note`	string	Reminder that the secret is not retrievable

Rate limit

10 requests per minute.

Limits use a fixed 60-second window and are shared across every API key on your account, so creating extra keys does not raise the ceiling. Every response carries RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset; a 429 adds Retry-After. See rate limits for the full table.

Errors

Status	Meaning
`400`	`url` missing, not HTTPS, malformed, or resolving to a non-public address
`403`	Monitoring is not enabled for this account
`429`	Rate limit exceeded. Wait `retry_after` seconds, then retry

Example

curl -X POST https://api.getxapi.com/twitter/monitor/webhook/create \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://your-server.com/hooks/getxapi" }'

Next: send yourself a test delivery to confirm signature verification works before attaching a real monitor.

Create Webhook