---
title: "Lists the organization's webhook subscriptions, oldest first."
method: GET
path: "/api/v1/orgs/{org}/webhooks"
tags: ["Webhooks"]
---

# Lists the organization's webhook subscriptions, oldest first.

`GET /api/v1/orgs/{org}/webhooks`

## Request

- Base URL: `https://api.featureflip.io`
- URL: `https://api.featureflip.io/api/v1/orgs/{org}/webhooks`
- Auth: API key in header `Authorization`

Requires Admin.

## Path parameters

- `org` string, required

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

OK

- PublicWebhookSubscriptionResponsePagedResult: A page of results plus an opaque cursor for the next page, or null when this is the last page. Wire keys are frozen: `items` (already lowercase under the camelCase policy) and `next_cursor` (pinned explicitly — the policy alone would emit `nextCursor`).
  - `items` PublicWebhookSubscriptionResponse[], nullable, required
    - `id` string, uuid, required
    - `name` string, nullable, required
    - `url` string, nullable, required
    - `provider` 'GenericHttp', nullable, required: Allowed values: GenericHttp.
    - `isEnabled` boolean, required
    - `eventTypes` string[], nullable, required
    - `projectIds` string[], nullable, required
    - `environmentIds` string[], nullable, required
    - `consecutiveFailureCount` integer, required
    - `autoDisabledAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `secrets` PublicWebhookSecretResponse[], nullable, required
      - `id` string, uuid, required
      - `createdAt` string, date-time, required
      - `retiredAt` string, date-time, nullable
    - `overPlanLimit` boolean, required
    - `_actions` object: Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.
  - `next_cursor` string, nullable
  - `_actions` object: Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.

## Other responses

- `401`: Authentication is required, or the supplied API token is invalid or expired.
- `403`: Forbidden
- `404`: Not Found
- `429`: Rate limit exceeded. Retry after the interval indicated by the Retry-After header.

---

[API](https://skmtc.dev/featureflip/apis/management-api.md) · [All operations](https://skmtc.dev/featureflip/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/featureflip/apis/management-api/revisions/8a77e8581a45?raw)