# List webhook subscriptions (https://terac.com/docs/developers/reference/listWebhookSubscriptions)

`GET https://terac.com/api/external/v2/hooks/subscriptions`

Lists every webhook subscription in your organization, one per target URL, with its event types and whether it is confirmed and enabled. Not paginated. Signing secrets are left out; read one from `GET /hooks/subscriptions/{subscriptionId}/secret`.

## Authorization

Requires a Bearer token via the `Authorization` header.

```
Authorization: Bearer <token>
```

## Responses

### 200: Every webhook subscription in the organization.

- `data` (array) **(required)**
  - `id` (string) **(required)**
  - `target_url` (string) **(required)**
  - `event_types` (array) **(required)**: Every event type this endpoint receives. PATCH replaces the whole list.
    - values: `submission.status.change`, `submission.approved`
  - `is_enabled` (boolean) **(required)**
  - `confirmed_at` (string, nullable) **(required)**: When this subscription passed the confirmation ping. Null means it receives nothing yet.
  - `disabled_at` (string, nullable) **(required)**
  - `disabled_reason` (string, nullable) **(required)**: Set when Terac disabled the subscription rather than you, after sustained delivery failure.
  - `created_at` (string) **(required)**
  - `updated_at` (string) **(required)**
### 400: Invalid input data

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**
### 401: The API key is missing, invalid, disabled, expired or revoked, its owner no longer exists, or it is not linked to an organization. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `UNAUTHORIZED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 403: Either the account that owns the API key is banned or deleted (from the key check, nested under `error`), or the key's owner lacks the organization permission this operation needs (from the operation, with `code` and `message` at the top level).

- One of: API key error (403)
  - `error` (object) **(required)**
    - `code` (string) **(required)**: one of: `FORBIDDEN`: The error code.
    - `message` (string) **(required)**: What went wrong.
- One of: Insufficient access error (403)
  - `message` (string) **(required)**: The error message
  - `code` (string) **(required)**: The error code
  - `issues` (array): An array of issues that were responsible for the error
    - `message` (string) **(required)**
### 404: Not found

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**
### 429: The API key is rate limited. A key accepts 100 requests, then refuses every request until more than 60 seconds pass with no accepted request; refused requests do not extend the wait. Wait the number of seconds in `Retry-After`, then retry. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `RATE_LIMITED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 500: Internal server error

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**