---
title: "List webhooks"
method: GET
path: "/v2/webhooks"
tags: ["Webhooks"]
---

# List webhooks

`GET /v2/webhooks`

List the webhooks in the organizations the user has access to, most
recently created first. Use `org_id` to narrow the list to a single
organization; a 404 is returned only when the given `org_id` does not
exist or is not accessible.

Webhooks used as monitor notification channels are included — a
webhook is an organization-level destination regardless of what it is
attached to.

<Warning>This endpoint is in alpha, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Warning>

## Query parameters

- `org_id` string — A universally unique identifier (base64-encoded opaque string).
- `name` string
- `limit` integer
- `cursor` string

## Response `200`

Returns a list of webhook objects

- ListWebhooksResponse
  - `webhooks` Webhook[], required — A list of webhooks
    - `id` string, required — A universally unique identifier (base64-encoded opaque string).
    - `organization_id` string, required — A universally unique identifier (base64-encoded opaque string).
    - `name` string, required — Name of the webhook (unique within the organization)
    - `description` string, required — A brief description of the webhook's purpose. Defaults to an empty string.
    - `url` string, uri, required — The HTTPS endpoint events are delivered to
    - `auth_type` 'BEARER' | 'HMAC_SHA256', required — How deliveries from this webhook are authenticated. - `BEARER`: the stored `auth_token` is sent verbatim as the `Authorization` header of each delivery request. - `HMAC_SHA256`: each delivery is signed with the webhook's signing secret. The `X-Arize-Webhook-Signature` header carries `v1=<hex-encoded HMAC-SHA256>` computed over `<timestamp>.<raw request body>`, where `<timestamp>` is the Unix-seconds value from the `X-Arize-Webhook-Timestamp` header and the raw body is the exact bytes received. Deliveries also carry `X-Arize-Webhook-Id` (event identifier) and `X-Arize-Webhook-Event` (event type). To verify, recompute the HMAC over the received timestamp and raw body with your stored secret and compare it to the signature.
    - `signing_secret_hint` string — Redacted hint of the signing secret (e.g. `whsec_…abcd`), useful for identifying which secret the webhook uses. Present only for `HMAC_SHA256` webhooks. The full secret is returned exactly once, in the create response, and cannot be retrieved afterwards.
    - `timeout_ms` integer, required — How long a delivery request may run before it is abandoned, in milliseconds. Defaults to 30000.
    - `headers` object, required — Custom HTTP headers sent with each delivery request
    - `created_at` string, date-time, required — Timestamp for when the webhook was created
    - `updated_at` string, date-time, required — Timestamp for when the webhook was last updated
    - `created_by_user_id` string — A universally unique identifier (base64-encoded opaque string).
  - `pagination` PaginationMetadata, required — Cursor-based pagination metadata. Use `next_cursor` in the subsequent request's `cursor` query parameter.
    - `next_cursor` string — Opaque cursor for fetching the next page. Treat as an unreadable token. Present when `has_more` is true; omitted when `has_more` is false.
    - `has_more` boolean, required — True if another page of results is available.

## Other responses

- `400` — Invalid request
- `401` — Authentication is required
- `403` — Insufficient permissions to access this resource
- `404` — Not found
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/arize-ai/apis/arize-rest-api.md) · [All operations](https://skmtc.net/arize-ai/apis/arize-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/arize-ai/arize-rest-api/revisions/1103033ea050/schema)