Skip to content
Hardcount
Run it locally
Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

List webhook endpoints

GET
/v1/webhook-endpoints/endpoints
curl --request GET \
  --url 'http://localhost:8080/v1/webhook-endpoints/endpoints?limit=50&offset=0' \
  --header 'Authorization: Bearer <token>'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer
default: 50 >= 1 <= 100

Rows per page, from 1 to 100. Default 50. Any other value, or one that is not a whole number, is a 422 with param: limit.

offset
integer
0

Rows to skip, 0 or more. Default 0. A negative value, or one that is not a whole number, is a 422 with param: offset.

Responses

Section titled “Responses”

200

Section titled “200”

Endpoint list

Media typeapplication/json
object
data
required
Array<object>
object
id
required
string
tenant_id
string
livemode
required
boolean
url
required
string
description
string
secret_last4
required
string
events
required

Subscribed event types. * means all.

Array<string>
active
required

False = paused.

boolean
secondary_secret_last4

The previous signing secret, during a rotation grace period.

string
secondary_secret_expires_at
string format: date-time
created_at
required
string format: date-time
updated_at
required
string format: date-time
total
required

How many rows match the request’s filters, on every page, not only this one. The audit log and the customer list’s search and name or email sort say where they stop counting.

integer

Example generated

{
  "data": [
    {
      "id": "example",
      "tenant_id": "example",
      "livemode": true,
      "url": "example",
      "description": "example",
      "secret_last4": "example",
      "events": [
        "example"
      ],
      "active": true,
      "secondary_secret_last4": "example",
      "secondary_secret_expires_at": "2026-04-15T12:00:00Z",
      "created_at": "2026-04-15T12:00:00Z",
      "updated_at": "2026-04-15T12:00:00Z"
    }
  ],
  "total": 1
}

422

Section titled “422”

limit or offset is out of range or not a whole number, or the request sends the removed after cursor (param names it)

Media typeapplication/json
object
error
object
type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string
code
string
message
string
request_id
string
param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example 

{
  "error": {
    "type": "invalid_request_error"
  }
}