List endpoints

GET/v1/webhooks

Secret key — sk_… or sk_test_… · Base URL https://api.volanea.com

Every endpoint registered for the project, with the event patterns each subscribes to and whether it is enabled.

This response includes each endpoint's whsec_… signing secret, not just the create call. That makes rotation-free recovery easy — you can always read the secret back — but it also makes this response a credential, so treat it like one and never proxy it to a browser.

Response

All endpoints.

dataobject[]required
- webhookEndpointIdstringrequired
- projectIdstring
- urlurirequired
- descriptionstring | null
- secretstringrequired
  `whsec_…` — used to HMAC-SHA256-sign every delivery (`X-Volanea-Signature: t=<ms>,v1=<hex>` over `<t>.<body>`).
- eventsarray | null
  Event name patterns, e.g. `["email.*", "contact.created"]`. Empty or null = all events.
- enabledbooleanrequired
- createdAtdate-timerequired

Errors

Every failure returns the standard envelope — branch on `code`, never on the wording of `error`.

401Missing or invalid API key.

Request

curl https://api.volanea.com/v1/webhooks \
  -H "Authorization: Bearer sk_..."

Response

200 · application/json

{
  "success": true,
  "data": {
    "data": [
      {
        "webhookEndpointId": "<webhookEndpointId>",
        "projectId": "<projectId>",
        "url": "https://yourapp.com/hooks/volanea",
        "description": "What this is for",
        "secret": "<secret>",
        "events": [
          "<events>"
        ],
        "enabled": true,
        "createdAt": "2026-01-01T09:00:00.000Z"
      }
    ]
  }
}

92 endpoints · OpenAPI document