---
title: "List webhook endpoints"
method: GET
path: "/webhooks"
tags: ["Webhooks"]
---

# List webhook endpoints

`GET /webhooks`

## Request

- Base URL: `https://api.customdomain.ai/v1`
- URL: `https://api.customdomain.ai/v1/webhooks`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

With an API key: endpoints across all the tenant's live apps (a test mode application's endpoints are left out unless `?app_id=` names it). With a test mode API key: that application's endpoints. With a widget JWT: the calling app's endpoints. Secrets are omitted.

## Query parameters

- `app_id` string

## Response `200`

Endpoints

- object
  - `webhooks` WebhookEndpoint[], required
    - `id` string, required
    - `application_id` string
    - `url` string, uri, required
    - `events` string[]
    - `secret` string, nullable: Present ONLY in the creation response (whsec_…). Deliveries are signed with it: each POST carries X-JE-Timestamp (unix seconds) and X-JE-Signature (sha256=hex of HMAC-SHA256 over "<timestamp>.<rawBody>"). Reject deliveries whose timestamp is outside a ~5-minute window.
    - `created_at` string, date-time

## Other responses

- `401`: Error envelope: {code, title, details}.
- `503`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)