# List webhook endpoints

Every endpoint registered by the business, oldest first.

Endpoint: GET /v1/webhooks
Version: 1.19
Security: ApiKey, ApiSecret, UserGuid, UserToken, SupplierGuid

## Security:

  - `ApiKey` (unknown)
    apiKey in header x-apiKey

  - `ApiSecret` (unknown)
    apiKey in header x-apiSecret

  - `UserGuid` (unknown)
    apiKey in header userGuid

  - `UserToken` (unknown)
    apiKey in header userToken

  - `SupplierGuid` (unknown)
    apiKey in header supplierGuid

## Response 200:

  - `200` (unknown)
    The endpoints and the per-business cap.

## Response 200 fields (application/json):

  - `webhooks` (array)

  - `webhooks.guid` (string, required)

  - `webhooks.name` (string, required)

  - `webhooks.url` (string, required)
    HTTPS URL deliveries are posted to.

  - `webhooks.active` (boolean, required)
    False pauses the endpoint; events that happen while it is paused are not queued.

  - `webhooks.events` (array, required)
    Subscribed event types. See `GET /v1/webhook-events` for the list.

  - `webhooks.workflow_triggers` (array, required)

  - `webhooks.workflow_triggers.workflow_guid` (string, required)

  - `webhooks.workflow_triggers.order_state_id` (integer, required)
    Order state id of the step (same ids as `Order.order_state_id`).

  - `webhooks.header_names` (array)
    Names of the static headers sent with every delivery.

  - `webhooks.api_version` (string, required)
    Payload version pinned when the endpoint was created (sent as `X-Orderwerks-Api-Version`).
    Example: 2026-10-27

  - `webhooks.consecutive_failures` (integer)
    Failed attempts since the last 2xx. Any 2xx resets it; at 50 the endpoint is disabled.

  - `webhooks.disabled_at` (string)
    Set when Orderwerks switched the endpoint off (failure streak or a `410 Gone`). Re-enable by updating `active` to true.

  - `webhooks.disabled_reason` (string)

  - `webhooks.last_delivery_at` (string)

  - `webhooks.last_success_at` (string)

  - `webhooks.previous_secret_expires_at` (string)
    While set, deliveries are also signed with the secret that was rotated out.

  - `webhooks.created_at` (string)

  - `webhooks.updated_at` (string)

  - `max_webhooks` (integer)
    Example: 10

## Response 401:

  - `401` (unknown)
    Missing or invalid credentials.

## Response 401 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).

## Response 403:

  - `403` (unknown)
    The credentials are valid but the user lacks the access level this endpoint requires.

## Response 403 fields (application/json):

  - `message` (string, required)
    Human-readable error message.
    Example: Invalid Catalog GUID

  - `error` (string)
    Underlying error detail, when available.

  - `code` (string)
    Machine-readable code for specific failures (for example `INVALID_DELTA_CURSOR`).