List webhook event types
Returns the event types available for subscription, each with English and Spanish descriptions,
whether the "*" wildcard covers it, and a representative data example. This is the
authoritative list of values accepted in events. webhook.test is listed (it can be sent with
POST /api/webhooks/{webhookId}/test) but cannot be subscribed to.
The Webhooks guide presents the same catalog as a table.
Idempotency. A read with no side effects. Safe to retry.
Access
- Required scope:
readorwrite. Any workspace role can call it. - Rate limit: General API — 120 requests/min per workspace on Starter or with no active plan, 200 on Growth, 300 on Business, 600 on Enterprise. See Rate limits.
- Plan: Available on every plan and also without an active subscription. See Billing and usage.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.