List webhooks

GET

https://api.jelliu.co/api/webhooks

GET

/api/webhooks

curl https://api.jelliu.co/api/webhooks \
     -H "Authorization: Bearer <token>"

{
  "data": [
    {
      "id": "5d2f8a4c-1b3e-4f6a-9c7d-8e0f1a2b3c4d",
      "url": "https://hooks.inmobiliariaandina.co/jelliu/llamadas",
      "description": "Sincronizar llamadas con el CRM",
      "events": [
        "call.completed",
        "call.failed"
      ],
      "filters": {
        "outcomes": [
          "interested",
          "appointment_booked"
        ]
      },
      "headers": {
        "Authorization": "[configured]"
      },
      "is_active": true,
      "disabled_reason": null,
      "disabled_at": null,
      "consecutive_failures": 0,
      "last_delivery_status": "succeeded",
      "last_delivery_at": "2026-09-27T21:04:05.402Z",
      "previous_secret_valid_until": null,
      "created_at": "2026-09-01T13:20:00.000Z",
      "updated_at": "2026-09-27T21:04:05.402Z"
    },
    {
      "id": "3c9e1f7a-6b2d-4e8a-a5c4-1f0b2d3e4a5b",
      "url": "https://siem.inmobiliariaandina.co/ingest/jelliu",
      "description": "Auditoría hacia el SIEM",
      "events": [
        "audit.log_recorded"
      ],
      "filters": {
        "audit_actions": [
          "webhook.",
          "FAILED_"
        ]
      },
      "headers": {},
      "is_active": false,
      "disabled_reason": "consecutive_failures",
      "disabled_at": "2026-09-26T09:13:59.871Z",
      "consecutive_failures": 20,
      "last_delivery_status": "failed",
      "last_delivery_at": "2026-09-26T09:13:59.871Z",
      "previous_secret_valid_until": null,
      "created_at": "2026-08-20T10:00:00.000Z",
      "updated_at": "2026-09-26T09:13:59.871Z"
    }
  ]
}

Returns the workspace’s outbound webhook endpoints, newest first, including disabled ones. Deleted endpoints are not returned. The list is not paginated (a workspace has at most 20 endpoints).

The signing secret is never returned. Custom header values are masked as "[configured]"; only the names are readable. Owners, admins and API keys with the full scope see the complete url; other readers see only its origin (https://hooks.example.com/…), because paths and query strings often carry tokens.

Idempotency. A read with no side effects. Safe to retry.

Access

Required scope: read or write. Any workspace role can call it.
Rate limit: General API — 120 requests/min per workspace on Starter or with no active plan, 200 on Growth, 300 on Business, 600 on Enterprise. See Rate limits.
Plan: Available on every plan and also without an active subscription, so a workspace can still review and remove its webhooks. Without a subscription no events are delivered. See Billing and usage.

Authentication

AuthorizationBearer

Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.

Scope	GET / HEAD	POST / PUT / PATCH / DELETE	Admin-only routes
`read`	Yes	No	No
`write`	Yes	Yes	No
`full`	Yes	Yes	Yes

Operations restricted to admins or owners reject keys without the full scope with 403, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See Authentication.

Response

The workspace's webhook endpoints, newest first.

datalist of objects

Endpoints ordered by created_at descending. Empty array when there are none.

Errors

401

Unauthorized Error

403

Forbidden Error

429

Too Many Requests Error