---
title: "List webhooks"
method: GET
path: "/api/webhooks"
tags: ["Webhooks"]
---

# List webhooks

`GET /api/webhooks`

## Request

- Base URL: `https://www.flyn.to`
- URL: `https://www.flyn.to/api/webhooks`
- Auth: HTTP bearer

Lists every webhook tagged with the caller's current workspace (teammates' included) plus the caller's own untagged webhooks, newest first. Secrets are masked for API-key callers.

**Auth:** API key (`Bearer flyn_sk_live_...`), or the signed-in dashboard session cookie when no API key header is sent. MCP OAuth access tokens are not accepted here and get 401.

**Plan:** every plan. Any team role.

**Rate limit:** 30 requests per 60 s per client IP, fixed window, in memory per server instance, checked before authentication.

## Response `200`

The webhooks.

- WebhookList
  - `webhooks` Webhook[], required
    - `id` string, uuid, required
    - `url` string, required: Delivery endpoint.
    - `events` string[], required: Subscribed event names, as stored.
    - `secret` string, nullable, required: Signing secret, `whsec_` + 48 hex. Always in full in the create response. Afterwards API-key callers see only a masked prefix (first 8 characters); the creator's own dashboard session sees it in full.
    - `status` 'active' | 'inactive', required: A webhook becomes inactive after 10 counted delivery failures in a row.
    - `createdAt` integer, required: Unix time in milliseconds.
    - `lastTriggeredAt` integer, nullable: Unix time in milliseconds of the last successful delivery. Absent from the create response.
    - `failureCount` integer, required: Counted failures since the last success (non-2xx answers, and skips of a URL whose host resolves to a private address or fails DNS resolution; timeouts and connection errors are not counted).

## Other responses

- `401`: No valid API key and no dashboard session. Messages: "Invalid or revoked API key", "API key has expired", "Unauthorized. Sign in to the dashboard, or pass a Bearer API key in the Authorization header.", or "Unauthorized" when the session lookup itself fails. An MCP OAuth token lands here too.
- `403`: The account is suspended.
- `429`: More than 30 requests in the window. Counted per client IP. Retry-After gives the seconds until the window resets.
- `500`: Database error.

---

[API](https://skmtc.dev/flyn/apis/flyn-api.md) · [All operations](https://skmtc.dev/flyn/apis/flyn-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flyn/apis/flyn-api/revisions/977962a98ccb?raw)