Skip to content
Kindgi

List webhook triggers

View as Markdown
GET
/v1/webhooks
curl --request GET \
  --url 'https://example.com/v1/webhooks?limit=25&status=active' \
  --header 'Authorization: Bearer <token>'

The tenant’s webhook triggers whose project the caller may read; with projectId, that project’s only (which needs read on it).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer
default: 25 >= 1 <= 100

1..100. Default 25.

cursor
string

Where the previous page ended: its nextCursor, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise 400 bad-input, and the list starts again without it. Absent → first page.

status

Lifecycle status. Only active triggers fire. Tombstoned rows are excluded from every read path.

string
Allowed values: active paused

Filter to triggers at a specific status. Values: active | paused.

projectId
string format: uuid

Only this project’s webhook triggers.

Responses

Section titled “Responses”

200

Section titled “200”

Page of webhook triggers.

Media typeapplication/json
object
data
required
Array<object>

A webhook trigger: a signed request to its receiveUrl starts a run of its flow, as its owner. The signing secret is never on it, only its name.

object
triggerId
required
string
webhookId
required

The routable id in the receive URL. Route-minted (a random UUID); unique per tenant. Not a secret: the signature is what a request is checked by.

string
receiveUrl

Where the sender posts: {public URL}/v1/hooks/{tenantId}/{webhookId}. Absent when the deployment has no public URL configured (KINDGI_PUBLIC_URL); it’s never taken from a request’s Host.

string format: uri
flowId
required
string
>= 1 characters
flowVersion
required
string
>= 1 characters
projectId
required

The trigger’s project: its runs are this project’s.

string format: uuid
owner
required

Who its runs act as: whoever registered it, until an admin takes it over (POST …/owner). Checked again at every delivery.

object
kind
required
string
Allowed values: user service
id
required
string
displayName

The owner’s name at the time of the response: the person’s display name, or the service account’s name. Absent when it can’t be read (no directory, a removed account) and from a runtime before Kindgi 0.1.6: show the id then.

string
input

The flow’s input on every delivery, in place of the event. Absent: the event (the body, parsed as JSON for a JSON content type, else its text).

hmacSecretName
required

The signing secret, by name (written with POST /v1/secrets, or made by generateSecret). Read in the env the deployment serves, at hmacSecretScope.

string
>= 1 characters
hmacSecretScope
One of:
One of:
object
kind
required
string
Allowed value: tenant
signingSecret

Only in the answer to a register with generateSecret: the new signing secret, shown this once, to paste into the sender. It’s stored as hmacSecretName in the trigger’s own scope; no later read shows it.

string
signature
required
One of:
object
kind
required
string
Allowed values: hmac-sha256
encoding
required
string
Allowed values: hex base64
header
required

The header that carries the signature (matched case-insensitively).

string
>= 1 characters <= 100 characters
prefix

Stripped from the header’s value before decoding (e.g. sha256=).

string
>= 1 characters <= 32 characters
deliveryIdHeader

The header whose value, with the body, is a delivery’s dedupe key (WooCommerce: X-WC-Webhook-Delivery-ID, which is per second, not per event, so the body counts too). Absent: deliveries aren’t deduped (standard-webhooks dedupes on its own webhook-id).

string
bodyLimitBytes
required

The largest body it takes (default 262144).

integer
>= 1024 <= 1048576
rateLimitPerMinute
required

Accepted deliveries a minute (default 600); past it, 429.

integer
>= 1 <= 6000
label
required
string | null
status
required

Lifecycle status. Only active triggers fire. Tombstoned rows are excluded from every read path.

string
Allowed values: active paused
statusReason

Why the runtime paused it (repeated refused or failed starts; a sender’s failed proofs never count), when it did.

string
suppressedRefusals

Refusals and skipped deliveries this minute past the 20 recorded in its history, which only counted.

object
since
required
string format: date-time
count
required
integer
>= 1
lastFiredAt
required
string | null format: date-time
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
nextCursor
string
hasMore
required
boolean
Example
{
  "data": [
    {
      "owner": {
        "kind": "user"
      },
      "hmacSecretScope": {
        "kind": "tenant"
      },
      "signature": {
        "kind": "hmac-sha256",
        "encoding": "hex"
      },
      "status": "active"
    }
  ]
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also