List webhooks

GET/api/v1/webhooks
Requires anorganization API keywith the scopewebhooks:read

Request

GET/api/v1/webhooks
curl -X GET 'https://app.mailyte.com/api/v1/webhooks' \
  -H 'Authorization: Bearer mk_live_YOUR_API_KEY'
The key names its own organization, so no X-Organization-ID header is needed.

Response

Success.

  • dataarray<object>
    • objectstringwebhook
    • idstring

      Unique identifier for the webhook.

    • namestring

      Your label for it. Never null: `webhooks.name` is NOT NULL, `POST /webhooks` requires it, and every response that carries a webhook at all -- list, create, update, toggle -- carries it.

    • urlstring

      Where events are POSTed. Must be reachable over HTTPS. Never null, for the same reason as `name`: the column is NOT NULL and creation requires it.

    • statusstringactive | inactive

      An `inactive` webhook is skipped by the dispatcher. It is not deleted and keeps its delivery history and its secret.

    • eventsarray<string>

      The events this endpoint receives. The enum is the complete set the dispatcher recognises. **`POST /webhooks` does not currently validate these names**: an unrecognised or misspelled value is accepted, stored verbatim, and then never fires, because subscriptions are matched exactly. You get a 200, a signing secret, and silence -- which is indistinguishable from a quiet integration. Check the spelling against this list before you rely on it. `quota.warning` is a legacy alias of `storage.quota.warning`; it still fires, but do not subscribe new webhooks to it.

    • targetingobject

      Narrows which of the subscribed events actually reach this endpoint. Every field is null when it is not narrowing, and **null is not the same as an empty list**: null matches everything, an empty list would match nothing. Null here is always NONE -- there is no such rule on this webhook -- never "we did not load the rule": the whole `filters` blob is one column, read with the row.

      • domainstring

        Exact match, because a domain is an identity and not a search term -- `acme.com` must not also match `notacme.com`. null = any domain.

      • sender_includesarray<string>

        Any-of substring match on the sender. null = not narrowed.

      • subject_containsarray<string>

        Any-of substring match on the subject. null = not narrowed.

      • body_containsarray<string>

        Any-of substring match on the body. null = not narrowed.

    • deliveriesobject

      The delivery history, grouped so the numbers cannot disagree.

      • succeededinteger

        Lifetime tally of accepted deliveries.

      • failedinteger

        Lifetime tally of failed deliveries.

      • consecutive_failuresinteger

        Resets to zero on any success. This is what drives auto-disable, so it answers a different question from `failed`.

      • success_ratenumber

        Percentage, 0-100, derived from the two tallies on read rather than stored. **null means no delivery has ever been attempted** -- NONE, not unknown, and emphatically not zero. "We have sent nothing" and "everything we sent failed" are opposite facts, and the shape this replaced rendered both as `0.00`: a caller alerting on a low success rate paged on every webhook that had simply never fired. Null is the only honest answer to "what fraction of nothing succeeded", so a client should show it as "no deliveries yet" and not substitute a number for it. `succeeded + failed == 0` is the same condition stated in integers.

    • last_delivered_atstring

      ISO 8601 UTC. **null means no delivery to this endpoint has ever been ACCEPTED** -- NONE, since the webhook was created, not "not recently" and not "we did not look". Read it precisely: the timestamp is written only when an attempt succeeds, so a webhook whose every attempt has failed reports null here while `deliveries.failed` climbs. null therefore does NOT mean "never tried" -- check `deliveries` for that. It is never cleared, so disabling and re-enabling a webhook does not reset it.

    • created_atstring

      ISO 8601 UTC.

Returned inside the standard envelope.

Errors

StatusWhen
401The API key is missing, unknown, revoked or expired. All four answer identically, on purpose: distinguishing them would confirm which keys exist.
403The key is valid but may not do this: it lacks the required scope, its IP allowlist does not include you, or this endpoint does not accept API keys.
404No such resource in this organization.
422The request was understood but the values were not acceptable.
429Too many requests, or the organization has spent its sending allowance. `Retry-After` says how long to wait.

Every status, with what causes it and what to do, is on the error reference.