---
title: "List registered webhooks"
method: GET
path: "/v1/webhooks"
tags: ["Webhooks"]
---

# List registered webhooks

`GET /v1/webhooks`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/webhooks`
- Auth: HTTP bearer

Returns the tenant's webhooks as a paginated list. Each item carries its source, events, and config. The plaintext secret is never present on list items.

## Query parameters

- `cursor` string
- `limit` integer

## Response `200`

A page of registered webhooks. The plaintext secret is never present on list items.

- object
  - `object` 'webhook_list': Response type discriminator.
  - `items` object[]: Page of registered webhooks.
    - `object` 'webhook': Response type discriminator.
    - `id` string: Webhook id (wh_-prefixed ULID).
    - `source` 'messaging' | 'user' | 'account_status' | 'post': The event source this webhook subscribes to.
    - `request_url` string: The URL that receives delivery POST requests.
    - `name` string, nullable
    - `account_ids` string[], nullable
    - `enabled` boolean
    - `headers` object[]: Custom headers added to each delivery POST, with a fingerprint in place of the value.
      - `key` string
      - `value_fingerprint` string, nullable: A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured.
    - `events` string[]
    - `data` string[]
    - `secret_prefix` string: First 8 characters of the secret (never the full secret).
    - `health` 'ok' | 'degraded': Delivery health state. 'degraded' when the last delivery exhausted all 5 attempts, or when it could not be signed at all because the webhook's signing secret is unusable (then no delivery can succeed; recreate the webhook).
    - `created_at` string
    - `last_delivery_at` string, nullable: ISO-8601 timestamp of the most recent delivery attempt, whether it succeeded or failed. Null when this webhook has never attempted a delivery.
    - `delivery_success_rate_7d` number, nullable: Percentage (0-100) of the last 7 days' delivery attempts that succeeded. Null when there were no attempts in that window; no data is not a perfect score. A webhook that attempted deliveries and failed every one returns 0, with a non-null last_delivery_at.
  - `cursor` string, nullable: Opaque next-page cursor. Null on the last page.
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `400`: Invalid pagination parameters, limit out of range or malformed cursor.
- `401`: Missing or invalid API key.
- `429`: Rate limited, slow down and retry after the hinted delay.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)