List webhooks
Lists the webhooks registered by the caller's organization, newest first. The page
uses keyset cursors: follow the next and prev links in the response. Requires the
org:connect:read permission.
Authorization
oauth2 Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.
In: header
Query Parameters
Number of webhooks per page. Defaults to 20; the maximum is 100.
0 < value20Cursor for the page after this one, from the response's next link.
Cursor for the page before this one, from the response's prev link.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/webhooks?size=20&after=eyJpZCI6IjU1MGU4NDAwLWUyOWItNDFkNC1hNzE2LTQ0NjY1NTQ0MDAwMCJ9&before=eyJpZCI6IjU1MGU4NDAwLWUyOWItNDFkNC1hNzE2LTQ0NjY1NTQ0MDAwMCJ9"{ "data": [ { "id": "550e8400-e29b-41d4-a716-446655440000", "name": "sales-app", "description": "Order updates for the sales app", "url": "https://sales.example.com/hooks/cowdi", "status": "ACTIVE", "events": [ "approval.outcome" ], "timeout": "PT5S", "signing_keys": [ { "id": "550e8400-e29b-41d4-a716-446655440001", "masked_secret": "whsec_...a1b2", "created_at": "2026-09-01T10:15:30Z" } ], "created_at": "2026-09-01T10:15:30Z", "updated_at": "2026-10-15T14:22:00Z" } ], "links": { "next": "/v1/payees?after=eyJpZCI6MX0", "prev": "/v1/payees?before=eyJpZCI6MX0" }}{ "code": "BAD_REQUEST", "description": "Bad Request"}{ "code": "UNAUTHORISED", "description": "Unauthorised"}{ "code": "FORBIDDEN", "description": "Forbidden"}{ "code": "RATE_LIMIT_EXCEEDED", "description": "Too Many Requests"}{ "code": "INTERNAL_ERROR", "description": "Internal Server Error"}Upgrade the organization to the latest API version POST
Moves the organization to the latest version at once. From then on, requests without a `Cowdi-Version` header run on it, and routes retired in it answer `410`. The version it replaced stays available for a rollback for 72 hours. An organization already on the latest version stays as it is. Requires the `org:connect:write` permission on the organization. Test the latest version first by sending it in the `Cowdi-Version` header.
Register a webhook POST
Registers a webhook and mints its first signing key. The signing secret is in the response and is never retrievable again. The URL must use `https` and must not resolve inside a private network, unless it matches a configured in-cluster host suffix. Requires the `org:connect:write` permission. Returns 400 when the URL is invalid or an `events` entry is not in the published vocabulary, and 409 when the name or URL already belongs to another webhook.