---
title: "Lists the organization's webhook subscriptions."
method: GET
path: "/api/v1/webhooks"
tags: ["Webhooks"]
---

# Lists the organization's webhook subscriptions.

`GET /api/v1/webhooks`

## Request

- Base URL: `https://app.flexonthejob.com`
- URL: `https://app.flexonthejob.com/api/v1/webhooks`
- Auth: HTTP bearer

Requires `ManageOrganizations`. The signing secret is never returned here — only once, when the subscription is created.

## Response `200`

The organization's subscriptions.

- WebhooksResponse: The organization's webhook subscriptions.
  - `webhooks` WebhookSubscriptionDto[]: Every active subscription for the organization.
    - `id` integer: Numeric id of the subscription. Example: `42`.
    - `url` string: The absolute `https` URL that receives the event payloads.
    - `events` string[]: The subscribed event names (see `GET /api/v1/webhooks/events`). Example: `["job.completed","invoice.paid"]`.
    - `active` boolean: Whether the subscription is currently delivering. Auto-disables after repeated failures.
    - `createdAt` string, date-time: When the subscription was created, ISO-8601 UTC.
    - `signingSecret` string, nullable: The HMAC signing secret for verifying the `X-Flex-Signature-V2` (`t=<unix seconds>,v1=<hex>` over `"<t>.<raw body>"`) and legacy `X-Flex-Signature` headers. Returned <b>only</b> in the response to `POST /api/v1/webhooks` (shown once, never retrievable again); `null` otherwise.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests

---

[API](https://skmtc.dev/flexonthejob/apis/flex-api.md) · [All operations](https://skmtc.dev/flexonthejob/apis/flex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flexonthejob/apis/flex-api/revisions/19c8f4d27acf?raw)