# List webhook endpoints

`GET /v1/webhook-endpoints` · permission `webhook-endpoints:read` · all plans

Returns the environment's webhook endpoints, newest first (`order=asc` for oldest first), in cursor pages. The response never contains a signing secret. The fields are described in [Get a webhook endpoint](get.md).

An environment can have at most this many **enabled** endpoints: Free 3, Startup 20, Business 20, Enterprise 50. Disabled endpoints do not count.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `limit` | query | no | 1–100 items per page; default 20. |
| `after` | query | no | Cursor from `list_metadata.after` of the previous page. |
| `before` | query | no | Cursor from `list_metadata.before`; cannot be combined with `after`. |
| `order` | query | no | `desc` (default) or `asc`. A cursor works only with the order it was issued for. |

## Response

`200 OK`. `list_metadata.after` is `null` on the last page; there is no total count.

```json
{
  "data": [
    {
      "id": "whe_01k8a3m5q7t9v1w3x5y7z9b2c4",
      "key": "crm-sync",
      "url": "https://hooks.example.com/keenauth",
      "description": "CRM sync",
      "event_types": ["user.created", "user.updated"],
      "event_schema_versions": {},
      "payload_mode": "thin",
      "status": "enabled",
      "rate_limit_per_second": 50,
      "previous_secret_expires_at": null,
      "last_success_at": "2026-10-26T09:12:00Z",
      "failing_since": null,
      "version": 1,
      "created_at": "2026-10-26T09:00:00Z",
      "updated_at": "2026-10-26T09:00:00Z"
    }
  ],
  "list_metadata": {"before": null, "after": null}
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `invalid_cursor` | The cursor is malformed, belongs to another environment or another sort order. |
| 422 | `validation_failed` | A query parameter is invalid (`/limit`, `/order`). |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks `webhook-endpoints:read`. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | Webhook administration is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/webhook-endpoints?limit=20 \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth webhook-endpoints list --limit 20`