---
title: "Webhook Events"
description: "List and get webhook events via the API Portal REST API."
canonical_url: https://wso2.com/api-platform/docs/api-portal/next/rest-api/webhook-events/
md_url: https://wso2.com/api-platform/docs/api-portal/next/rest-api/webhook-events.md
tags:
  - cloud
  - api-portal
  - rest-api
author: WSO2 API Platform Documentation Team
last_updated: 2026-07-24
content_type: "reference"
---

# Webhook Events

## List webhook events

<a id="opIdlistWebhookEvents"></a>

`GET /webhook-events`

> Code samples

```shell

curl -X GET https://localhost:9543/api-portal/api/v0.9/webhook-events \
  -H 'Authorization: Bearer {access_token}' \
  -H 'Accept: application/json'

```

Returns a paginated list of webhook events for the organization. Each event includes a summary of its delivery rows. Requires the `dp:event:read` scope.

### Authentication

<aside class="warning">
This operation requires a <strong>Bearer JWT</strong> access token in the <code>Authorization</code> header.

Required scopes (the token must carry at least one of): `dp:event:read`

</aside>

<h3 id="list-webhook-events-parameters">Parameters</h3>

|Name|In|Type|Required|Description|
|---|---|---|---|---|
|status|query|string|false|Filter events by status.|
|limit|query|integer|false|Maximum number of records to return.|
|offset|query|integer|false|Number of records to skip before returning results.|

#### Enumerated Values

|Parameter|Value|
|---|---|
|status|PENDING|
|status|DISPATCHED|
|status|ALL_DELIVERED|
|status|FAILED|

> Example responses
>
> 200 Response

```json
{
  "list": [
    {
      "eventId": "evt-abc123",
      "eventType": "apikey.generated",
      "orgId": "org-default",
      "aggregateType": "apikey",
      "aggregateId": "key-12345",
      "status": "ALL_DELIVERED",
      "occurredAt": "2019-08-24T14:15:22Z",
      "deliveries": [
        {
          "deliveryId": "del-abc123",
          "subscriberId": "sub-xyz789",
          "targetUrl": "https://example.com/webhook",
          "status": "DELIVERED",
          "lastHttpStatus": 200,
          "lastError": "string",
          "lastAttemptAt": "2019-08-24T14:15:22Z",
          "deliveredAt": "2019-08-24T14:15:22Z"
        }
      ]
    }
  ],
  "count": 1,
  "pagination": {
    "total": 42,
    "limit": 20,
    "offset": 0
  }
}
```

> 403 Response

```json
{
  "status": "error",
  "code": "FORBIDDEN",
  "message": "Forbidden"
}
```

> 500 Response

```json
{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}
```

<h3 id="list-webhook-events-responses">Responses</h3>

|Status|Meaning|Description|Schema|
|---|---|---|---|
|200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|Paginated list of webhook events.|Inline|
|403|[Forbidden](https://tools.ietf.org/html/rfc7231#section-6.5.3)|Request is forbidden. The caller lacks the required permission, or the current runtime mode disallows the operation (read-only mode). It is also returned when the request names an organization other than the single one this instance serves. A nonexistent organization is answered identically to one belonging to someone else, so the response cannot be used to discover what a shared database holds.|[ErrorResponse](schemas.md#schemaerrorresponse)|
|500|[Internal Server Error](https://tools.ietf.org/html/rfc7231#section-6.6.1)|Internal server error.|[ErrorResponse](schemas.md#schemaerrorresponse)|

<h3 id="list-webhook-events-responseschema">Response schema</h3>

Status Code **200**

|Name|Type|Required|Restrictions|Description|
|---|---|---|---|---|
|» list|[[WebhookEvent](schemas.md#schemawebhookevent)]|false|none|[A webhook event with its delivery rows.]|
|»» eventId|string|false|none|none|
|»» eventType|string|false|none|none|
|»» orgId|string|false|none|none|
|»» aggregateType|string|false|none|none|
|»» aggregateId|string|false|none|none|
|»» status|string|false|none|none|
|»» occurredAt|string(date-time)|false|none|none|
|»» deliveries|[[WebhookEventDelivery](schemas.md#schemawebhookeventdelivery)]|false|none|[A single webhook delivery attempt.]|
|»»» deliveryId|string|false|none|none|
|»»» subscriberId|string|false|none|none|
|»»» targetUrl|string¦null|false|none|none|
|»»» status|string|false|none|none|
|»»» lastHttpStatus|integer¦null|false|none|none|
|»»» lastError|string¦null|false|none|none|
|»»» lastAttemptAt|string(date-time)¦null|false|none|none|
|»»» deliveredAt|string(date-time)¦null|false|none|none|
|» count|integer|false|none|Number of items returned in this page.|
|» pagination|[Pagination](schemas.md#schemapagination)|false|none|Standard pagination metadata returned with collection responses.|
|»» total|integer|true|none|Total number of records matching the query.|
|»» limit|integer|true|none|Maximum number of records returned in this response.|
|»» offset|integer|true|none|Number of records skipped before this page.|

#### Enumerated Values

|Property|Value|
|---|---|
|status|PENDING|
|status|DISPATCHED|
|status|ALL_DELIVERED|
|status|FAILED|
|status|PENDING|
|status|IN_FLIGHT|
|status|DELIVERED|
|status|FAILED|

## Get a webhook event

<a id="opIdgetWebhookEvent"></a>

`GET /webhook-events/{eventId}`

> Code samples

```shell

curl -X GET https://localhost:9543/api-portal/api/v0.9/webhook-events/{eventId} \
  -H 'Authorization: Bearer {access_token}' \
  -H 'Accept: application/json'

```

Returns a single webhook event with the full details of all its delivery rows. Requires the `dp:event:read` scope.

### Authentication

<aside class="warning">
This operation requires a <strong>Bearer JWT</strong> access token in the <code>Authorization</code> header.

Required scopes (the token must carry at least one of): `dp:event:read`

</aside>

<h3 id="get-a-webhook-event-parameters">Parameters</h3>

|Name|In|Type|Required|Description|
|---|---|---|---|---|
|eventId|path|string|true|Webhook event identifier.|

> Example responses
>
> 200 Response

```json
{
  "eventId": "evt-abc123",
  "eventType": "apikey.generated",
  "orgId": "org-default",
  "aggregateType": "apikey",
  "aggregateId": "key-12345",
  "status": "ALL_DELIVERED",
  "occurredAt": "2019-08-24T14:15:22Z",
  "deliveries": [
    {
      "deliveryId": "del-abc123",
      "subscriberId": "sub-xyz789",
      "targetUrl": "https://example.com/webhook",
      "status": "DELIVERED",
      "lastHttpStatus": 200,
      "lastError": "string",
      "lastAttemptAt": "2019-08-24T14:15:22Z",
      "deliveredAt": "2019-08-24T14:15:22Z"
    }
  ]
}
```

> 403 Response

```json
{
  "status": "error",
  "code": "FORBIDDEN",
  "message": "Forbidden"
}
```

> 404 Response

```json
{
  "status": "error",
  "code": "ORG_NOT_FOUND",
  "message": "Organization not found."
}
```

> 500 Response

```json
{
  "status": "error",
  "code": "INTERNAL_SERVER_ERROR",
  "message": "An unexpected error occurred."
}
```

<h3 id="get-a-webhook-event-responses">Responses</h3>

|Status|Meaning|Description|Schema|
|---|---|---|---|
|200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|Single webhook event with full delivery details.|[WebhookEvent](schemas.md#schemawebhookevent)|
|403|[Forbidden](https://tools.ietf.org/html/rfc7231#section-6.5.3)|Request is forbidden. The caller lacks the required permission, or the current runtime mode disallows the operation (read-only mode). It is also returned when the request names an organization other than the single one this instance serves. A nonexistent organization is answered identically to one belonging to someone else, so the response cannot be used to discover what a shared database holds.|[ErrorResponse](schemas.md#schemaerrorresponse)|
|404|[Not Found](https://tools.ietf.org/html/rfc7231#section-6.5.4)|Resource not found.|[ErrorResponse](schemas.md#schemaerrorresponse)|
|500|[Internal Server Error](https://tools.ietf.org/html/rfc7231#section-6.6.1)|Internal server error.|[ErrorResponse](schemas.md#schemaerrorresponse)|