Webhooks

List webhooks

List the tenant's webhooks, newest-first by default, with cursor pagination. The signing secret is never included in a listing — it is shown only once at creation.

GET
/webhooks

List the tenant's webhooks, newest-first by default, with cursor pagination. The signing secret is never included in a listing — it is shown only once at creation.

Authorization

x-api-key<token>

The per-tenant API key. Sent as the x-api-key request header. The key is tenant-scoped.

In: header

Query Parameters

limit?integer

Page size, 1-100. Defaults to 50.

page_token?string

Opaque token from a previous page's next_page_token. Omit for the first page.

ascending?boolean

Sort oldest-first when true. Defaults to newest-first.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/webhooks"
{  "count": 0,  "limit": 0,  "next_page_token": "string",  "webhooks": [    {      "webhook_id": "string",      "url": "http://example.com",      "event_types": [        "message.received"      ],      "inbox_ids": [        "user@example.com"      ],      "enabled": true,      "client_id": "string",      "created_at": "2019-08-24T14:15:22Z",      "updated_at": "2019-08-24T14:15:22Z"    }  ]}
{  "name": "validation",  "errors": {    "property1": "string",    "property2": "string"  }}
{  "name": "string",  "message": "string"}
{  "name": "string",  "message": "string"}
{  "name": "string",  "message": "string"}

Get a webhook GET

Fetch a single webhook by id. An unknown id and an id belonging to another tenant both return the same not-found error — existence is never leaked. The signing secret is not included (shown only at creation).

A message-received event delivered to your endpoint Webhook

The payload delivered to a registered webhook endpoint the moment a message is received in one of your inboxes — and the same envelope the **WebSocket** stream relays for a live connection. The delivery is signed; verify the signature before trusting the body. `event_type` carries the dotted spelling over webhooks/REST (the WebSocket stream uses the underscore spelling); the two classified variants (`message.received.spam`, `message.received.unauthenticated`) are only delivered to endpoints/keys permitted to read classified mail.