---
title: "List webhook subscriptions"
method: GET
path: "/webhooks"
tags: ["Webhooks"]
---

# List webhook subscriptions

`GET /webhooks`

## Request

- Base URL: `https://inkseal.net/api/v1`
- URL: `https://inkseal.net/api/v1/webhooks`
- Auth: HTTP bearer

Every webhook subscription the workspace owns, newest first. The signing secret is never included: it is returned once at creation and is stored encrypted afterwards.

`events` is either an explicit list of event names or `null`, which subscribes to every supported event, including ones added after the subscription was made.

## Response `200`

Every subscription in the workspace, newest first. Not paginated.

- object
  - `data` WebhookSubscription[], required
    - `id` string, required: The subscription's public identifier.
    - `url` string, uri, required: The HTTPS endpoint deliveries are POSTed to.
    - `events` WebhookSubscriptionEventType[], nullable, required: The events subscribed to, or null for every event including ones added in future releases.
    - `isActive` boolean, required: False pauses delivery without destroying the subscription or its history.
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `401`: The credential is missing, malformed, unknown, expired, revoked, or past its rotation grace window. Code: `unauthorized`. Every authentication failure is deliberately indistinguishable.
- `403`: The credential is valid but may not do this. Codes: `insufficient_scope` (the route's scopes are not all held; `details` names `requiredScopes` and `missingScopes`), `forbidden` (the capability check on the resolved resource failed), `scope_escalation` (a grant wider than the caller's own was requested).
- `429`: A limit was reached. Codes: `rate_limited` (the credential's per-bucket HTTP limit, or the per-workspace detection throttle), `workspace_limit_exceeded` (a workspace content or send limit; `details.limit` names it), `daily_budget_exceeded` (the workspace's daily detection budget). The four rate-limit headers are sent on this response and on no successful one, so a client cannot read its remaining budget without being refused. Retrying after `Retry-After` is always safe: a rate-limit refusal happens before the handler runs.
- `503`: A dependency the request needs is unreachable and nothing was changed. Codes: `queue_unavailable` (a background job could not be enqueued; retry the call), `billing_unavailable` (Stripe would not open a checkout session; nothing was charged, retry the call), `service_unavailable` (the rate-limit store is down, so the request was refused before running).

---

[API](https://skmtc.dev/inkseal/apis/inkseal-api.md) · [All operations](https://skmtc.dev/inkseal/apis/inkseal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inkseal/apis/inkseal-api/revisions/c440c981d578?raw)