List your event endpoints (signed webhooks, Slack incoming webhooks, GitHub repository_dispatch).

GEThttps://api.appgoat.ai/v1/webhooks

FreeoperationId listWebhooks

Request

curl "https://api.appgoat.ai/v1/webhooks" \
  -H "x-api-key: $APPGOAT_API_KEY"

const res = await fetch("https://api.appgoat.ai/v1/webhooks", {
  headers: {
    "x-api-key": process.env.APPGOAT_API_KEY,
  },
});
const { data, meta } = await res.json();

import os, requests

res = requests.get(
    "https://api.appgoat.ai/v1/webhooks",
    headers={"x-api-key": os.environ["APPGOAT_API_KEY"]}
)
body = res.json()

Response

200 with data: WebhookEndpoint[]. See the envelope for meta.

idinteger

kind"webhook" | "slack" | "github"

urlstring

github: owner/repo; slack: shortened (the URL is a credential).

descriptionstring | null

event_typesEventType[] | null

activeboolean

disabled_reasonstring | null

failure_countinteger

Consecutive failed attempts.

last_success_atstring | null

last_failure_atstring | null

secretstring

kind webhook: the signing secret, only in the create / rotate response.

secret_hintstring

created_atstring

updated_atstring

Example

{
  "data": [
    {
      "id": 1,
      "kind": "webhook",
      "url": "string",
      "description": "string",
      "event_types": [
        "new_version"
      ],
      "active": false,
      "disabled_reason": "string",
      "failure_count": 1,
      "last_success_at": "2026-10-22T10:00:00Z",
      "last_failure_at": "2026-10-22T10:00:00Z",
      "secret": "string",
      "secret_hint": "string",
      "created_at": "2026-10-22T10:00:00Z",
      "updated_at": "2026-10-22T10:00:00Z"
    }
  ],
  "meta": {
    "credits_used": 0,
    "credits_remaining": 9981,
    "request_id": "req_123"
  }
}

Status codes

200

Endpoints.

401invalid_api_key

Missing or invalid API key.

429rate_limited

Too many requests per second for your plan.