> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List webhooks

> Returns an array of all webhooks.

GET/webhooks

Returns an array of all webhooks.

This endpoint supports [field filtering](https://www.marqeta.com/docs/core-api/field-filtering.md), [sorting](https://www.marqeta.com/docs/core-api/sorting-and-pagination.md), and [pagination](https://www.marqeta.com/docs/core-api/sorting-and-pagination.md).

> [!NOTE]
>
> **Note**\
> As shown in the example, `config.secret`, `config.basic_auth_username`, and `config.basic_auth_password` are masked in responses to this and all other requests. To ensure that you can access these values as needed, update them on your endpoint, store them securely, and then [update the webhook subscription](https://www.marqeta.com/docs/core-api/webhooks/update-webhook.md).

## URL query parameters

| Fields | Description |
| - | - |
| active boolean  Optional | Set to `true` to return only active webhook configurations, otherwise all webhook configurations will be returned. **Allowable Values:**  `true`, `false` |
| count integer  Optional | Number of resources to retrieve. **Allowable Values:**  1-10 **Default value:** 5 |
| start\_index integer  Optional | Sort order index of the first resource in the returned array. **Allowable Values:**  Any integer **Default value:** 0 |
| fields string  Optional | Comma-delimited list of fields to return (`field_1,field_2`, and so on). Leave blank to return all fields. **Allowable Values:**  Comma-delimited list of fields, or blank |
| sort\_by string  Optional | Field on which to sort. Use any field in the resource model, or one of the system fields `lastModifiedTime` or `createdTime`. Prefix the field name with a hyphen (`-`) to sort in descending order. Omit the hyphen to sort in ascending order. **Allowable Values:**  `createdTime`, `lastModifiedTime`, or any field in the resource model **Default value:** `-createdTime` |

## Response body

| Fields | Description |
| - | - |
| count integer  Conditionally returned | Number of resources to retrieve. This field is returned if there are resources in your returned array. **Allowable Values:**  1-10 |
| data array of objects  Conditionally returned | Array of webhooks resources. Resources are returned as appropriate to your query. **Allowable Values:**  Valid array of one or more webhook objects |
| data\[].**active** boolean  Conditionally returned | Indicates whether the webhook is active. This field is returned if you included it in your webhook. **Allowable Values:**  `true`, `false` |
| data\[].**config** object  Returned | Contains the configuration information for the webhook. **Allowable Values:**  `basic_auth_password`, `basic_auth_username`, `custom_header`, `secret`, `url`, `use_mtls` |
| data\[].config.**basic\_auth\_password** string  Returned | Password for accessing your webhook endpoint. **Allowable Values:**  12 chars  The first character of the password, followed by 10 asterisks and the last character of the password. |
| data\[].config.**basic\_auth\_username** string  Returned | Username for accessing your webhook endpoint. **Allowable Values:**  12 chars  The first character of the username, followed by 10 asterisks and the last character of the username. |
| data\[].config.**custom\_header** object  Conditionally returned | Custom headers to be passed along with the request. **Allowable Values:**  Up to three name-value pairs: 500 char max per name, 500 char max per value |
| data\[].config.**secret** string  Conditionally returned | Randomly chosen string used for implementing HMAC-SHA1 or HMAC-SHA256, depending on the value included in the `signature_algorithm` field. A signature provides an added layer of security by authenticating the message and validating message integrity. Using this functionality requires that your webhook endpoint verify the message signature. For information about implementing this functionality, see [Signature Verification](https://www.marqeta.com/docs/developer-guides/signature-verification.md). **Allowable Values:**  12 chars  The first character of the secret, followed by 10 asterisks and the last character of the secret. |
| data\[].config.**signature\_algorithm** string  Conditionally returned | Algorithm used for signature verification. A signature provides an added layer of security by authenticating the message and validating message integrity. Using this functionality requires that your webhook endpoint verify the message signature. For information about implementing this functionality, see [Signature Verification](https://www.marqeta.com/docs/developer-guides/signature-verification.md). **Allowable Values:**  1–20 chars  - Value must be either `HMAC_SHA_1` (legacy) or `HMAC_SHA_256` (recommended).  - You must specify this value if `secret` is specified. |
| data\[].config.**url** string  Returned | URL of your webhook endpoint. **Allowable Values:**  1–255 chars  - Must be HTTPS  - Empty string not allowed |
| data\[].config.**use\_mtls** boolean  Conditionally returned | Set to `true` to use use mutual transport layer security (mTLS) authentication for the webhook. mTLS authentication is in the beta testing phase, and is not yet generally available. Contact your Marqeta representative for more information about using mTLS authentication. **Allowable Values:**  `true`, `false` |
| data\[].**created\_time** datetime  Conditionally returned | Date and time when the webhook event was created, in UTC. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| data\[].**events** array of strings  Returned | Specifies the event types that trigger notifications. Use the wildcard character `*` to subscribe to all webhook notifications or all notifications within a specific category. For example, `transaction.*` . **Note:** The wildcard character does not return L2 and L3 card data events. **Note:** Use the wildcard character only with the base type events (`cardtransition.*`) not subcategories (`cardtransition.fulfillment.*`). **Allowable Values:**  For a comprehensive list of events, see [Event Types](https://www.marqeta.com/docs/core-api/event-types.md). |
| data\[].**last\_modified\_time** datetime  Conditionally returned | Date and time when the associated object was last modified, in UTC. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| data\[].**name** string  Returned | Descriptive name of the webhook. **Allowable Values:**  1–64 chars |
| data\[].**token** string  Conditionally returned | Unique identifier of the webhook. **Allowable Values:**  1–36 chars |
| end\_index integer  Conditionally returned | Sort order index of the last resource in the returned array. This field is returned if there are resources in your returned array. **Allowable Values:**  Any integer |
| is\_more boolean  Conditionally returned | A value of `true` indicates that more unreturned resources exist. A value of `false` indicates that no more unreturned resources exist. This field is returned if there are resources in your returned array. **Allowable Values:**  Any integer |
| start\_index integer  Conditionally returned | Sort order index of the first resource in the returned array. This field is returned if there are resources in your returned array. **Allowable Values:**  Any integer |

## Sample response body

```json JSON expandable lines wrap theme={null}
{
  "count": 1,
  "start_index": 0,
  "end_index": 0,
  "is_more": true,
  "data": [
    {
      "name": "my_webhook_name",
      "active": true,
      "config": {
        "url": "https://my_secure_domain.com/webhook",
        "secret": "m**********t",
        "signature_algorithm": "HMAC_SHA_256",
        "basic_auth_username": "m**********e",
        "basic_auth_password": "m**********d",
        "custom_header": {
          "my_header_name_1": "my_value_1",
          "my_header_name_2": "my_value_2",
          "my_header_name_3": "my_value_3"
        }
      },
      "events": [
        "*"
      ],
      "token": "my_webhook_token",
      "created_time": "2023-02-24T23:20:28Z",
      "last_modified_time": "2023-02-24T23:20:28Z"
    }
  ]
}
```


## Related topics

- [Webhooks Overview](https://www.marqeta.com/docs/core-api/webhooks.md)
- [About Webhooks](https://www.marqeta.com/docs/developer-guides/about-webhooks.md)
- [Set Up a Webhook Handler](https://www.marqeta.com/docs/developer-guides/disputes-sandbox/disputes-webhook-handler.md)
- [Update webhook](https://www.marqeta.com/docs/core-api/webhooks/update-webhook.md)
- [Create webhook](https://www.marqeta.com/docs/core-api/webhooks/create-webhook.md)