---
title: "List package.json#kody.webhooks declarations across the signed-in user's saved packages, joined with minted handle / ..."
method: GET
path: "/v1/webhooks"
tags: ["webhooks"]
---

# List package.json#kody.webhooks declarations across the signed-in user's saved packages, joined with minted handle / ...

`GET /v1/webhooks`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/webhooks`
- Auth: HTTP bearer

List package.json#kody.webhooks declarations across the signed-in user's saved packages, joined with minted handle / enabled state. Declaring a webhook does not open ingress until webhookUrlMint is called. URL secrets and credential URLs are never returned.

Org permission: `package:read`.

## Query parameters

- `packageId` string
- `kodyId` string

## Response `200`

Success.

- object
  - `webhooks` object[], required
    - `package_id` string, required
    - `package_kody_id` string, required
    - `package_name` string, required
    - `name` string, required
    - `export_name` string, required
    - `description` string, nullable, required
    - `response_mode` 'ack' | 'sync', required
    - `input_mode` 'request' | 'params', required
    - `rate_limit_per_minute` integer, required
    - `verification` union, required
      - object
        - `type` 'hmac-sha256' | 'hmac-sha1', required
        - `header` string, required
        - `secretName` string
        - `encoding` 'hex' | 'base64', required
        - `prefix` string
        - `signedPayload` 'body' | 'timestamp.body'
      - object
        - `type` 'url-secret', required
    - `replay` object, nullable, required
      - `timestampHeader` string
      - `timestampFormat` 'unix-seconds' | 'unix-millis' | 'iso-8601' | 'stripe-signature'
      - `toleranceSeconds` integer
      - `deliveryIdHeader` string
    - `challenge` object, nullable, required: Platform-answered subscription challenge from package.json#kody.webhooks[].challenge (secretName is a secret-store name, never a value). Null when not declared.
      - `type` 'subscription-challenge', required
      - `method` 'GET' | 'POST', required
      - `challenge` object, required
        - `in` 'query' | 'json', required
        - `key` string, required
      - `when` object
        - `query` object
        - `json` object
      - `prove` union
        - object
          - `kind` 'none', required
        - object
          - `kind` 'verify-token', required
          - `in` 'query', required
          - `key` string, required
          - `secretName` string, required
          - `required` boolean
        - object
          - `kind` 'hmac', required
          - `secretName` string, required
          - `algorithm` 'hmac-sha256', required
          - `encoding` 'hex' | 'base64', required
          - `prefix` string
        - object
          - `kind` 'request-hmac', required
          - `secretName` string, required
          - `algorithm` 'hmac-sha256', required
          - `encoding` 'hex' | 'base64', required
          - `prefix` string
          - `timestampHeader` string, required
          - `signatureHeader` string, required
          - `signedPayload` 'v0.timestamp.body', required
      - `respond` union, required
        - object
          - `as` 'text', required
        - object
          - `as` 'json', required
          - `key` string, required
        - object
          - `as` 'json-hmac', required
          - `key` string, required
    - `minted` boolean, required: True when a URL secret has been minted for this webhook.
    - `endpoint_id` string, nullable, required: Webhook endpoint id when minted. Pass to rotate/enable/disable when several URLs share the name. Null when not minted.
    - `instance_label` string, nullable, required: Short label when several URLs share the declared webhook name. Null when unlabeled or not minted.
    - `handle` string, nullable, required: Opaque handle for webhookUrlApply. Null when not minted. Never a credential.
    - `url_host` string, nullable, required: Public hostname of the ingress origin. Null when not minted.
    - `enabled` boolean, nullable, required: Null when not minted; otherwise the mint enabled flag.
    - `created_at` string, nullable, required
    - `rotated_at` string, nullable, required
    - `previous_url_active_until` string, nullable, required: ISO timestamp while the previous URL still accepts deliveries after rotate. Null when there is no live overlap.

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)