> ## Documentation Index > Fetch the complete documentation index at: https://docs.godiligent.ai/llms.txt > Use this file to discover all available pages before exploring further. # List Webhooks > List all webhooks registered for your account. ## Endpoint `GET /webhooks` Returns all webhooks registered for the authenticated customer. ## Response A JSON array of webhook objects. The signing `secret` is never returned; `has_secret` indicates whether one is configured. | Field | Type | Description | | ---------------------- | -------------- | -------------------------------------------------------------------------------------- | | id | string | Unique webhook ID. | | webhook\_url | string | The endpoint URL. | | is\_active | boolean | Whether the webhook is active. | | has\_secret | boolean | Whether a signing secret is configured. | | status | string | Derived health: `disabled` (inactive), `failing` (last delivery non-2xx), or `active`. | | last\_delivery\_at | string \| null | ISO timestamp of the most recent delivery attempt, or `null` if none. | | last\_delivery\_status | number \| null | HTTP status of the most recent delivery attempt, or `null` if none. | | events | string\[] | Subscribed event types. | ### Example Response ```json theme={null} [ { "id": "df89eb16-4c6a-439f-b668-7cca0cd786fa", "webhook_url": "https://crm.example.com/diligent", "is_active": true, "has_secret": true, "status": "active", "last_delivery_at": "2025-07-31T02:51:34.155Z", "last_delivery_status": 200, "events": ["cdd_state_changed", "alert_remediated"] }, { "id": "5a1c0b2e-9f3d-4a7b-8c6d-2e1f0a9b8c7d", "webhook_url": "https://warehouse.example.com/ingest", "is_active": false, "has_secret": false, "status": "disabled", "last_delivery_at": null, "last_delivery_status": null, "events": ["search_completed"] } ] ``` ## Authentication This endpoint requires authentication. Only webhooks owned by the authenticated customer are returned. ## OpenAPI ````yaml GET /webhooks openapi: 3.0.1 info: version: 1.5.0 title: Diligent description: > Download Postman collection [here](https://docs.godiligent.ai/files/postman_collection.json). servers: - url: https://api.godiligent.ai description: Production - url: https://api.sandbox.godiligent.ai description: Sandbox security: - xApiKey: [] tags: - name: CDD description: Customer Due Diligence - name: Company description: Company Information - name: Blocked Companies description: Manage blocked companies - name: Monitorings description: Website monitoring and alerts for changes and risks - name: Webhooks description: > ## How to Secure Webhook Deliveries To ensure that webhook payloads are securely transmitted and verified. This guide explains how to configure and validate webhook deliveries using a shared secret. ### How It Works When setting up a webhook, a secret is configured on both the sender (our system) and the receiver (your endpoint). Each webhook payload is signed using this secret, allowing the receiver to verify its authenticity. #### Step 1: Configuring Your Webhook Secret 1. When creating a webhook in our system, specify a unique secret key. This secret should be a strong, randomly generated string. 2. Store this secret securely on your server; it should never be exposed publicly. #### Step 2: Receiving Webhook Payloads When your server receives a webhook event, the request will include an `X-Signature` header containing a HMAC signature of the payload. Example header: ``` X-Signature: sha256=abcdef1234567890... ``` #### Step 3: Validating the Webhook Signature To verify the webhook payload: 1. Retrieve the `X-Signature` value from the request headers. 2. Compute the HMAC SHA-256 signature of the request payload using your webhook secret. 3. Compare the computed signature with the one in the `X-Signature` header. 4. If they match, the webhook is valid. #### (Python) ```python import hashlib import hmac import json def verify_webhook_signature(secret, payload, signature): computed_signature = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).hexdigest() expected_signature = f"sha256={computed_signature}" return hmac.compare_digest(expected_signature, signature) # Example usage: secret = "your_webhook_secret" payload = json.dumps({"event": "example"}) received_signature = "sha256=abcdef1234567890..." if verify_webhook_signature(secret, payload, received_signature): print("Valid webhook received!") else: print("Invalid webhook signature!") ``` #### (JavaScript) ```javascript const crypto = require('crypto'); function verifyWebhookSignature (secret, payload, signature) { const computedSignature = `sha256=${crypto.createHmac('sha256', secret) .update(payload) .digest('hex')}`; return crypto.timingSafeEqual(Buffer.from(computedSignature), Buffer.from(signature)); } // Example usage: const secret = "your_webhook_secret"; const payload = JSON.stringify({ event: "example" }); const receivedSignature = "sha256=abcdef1234567890..."; if (verifyWebhookSignature(secret, payload, receivedSignature)) { console.log("Valid webhook received!"); } else { console.log("Invalid webhook signature!"); } ``` #### Security Considerations - Always use HTTPS to prevent interception of webhook payloads. - Reject webhook requests that fail signature validation. - Rotate secrets periodically to enhance security. By following this guide, you ensure that webhook deliveries are secure and trusted. - name: Instant Screening (experimental) description: Instant Website Screening API - name: Name Screening description: Name screening search, alert management and remediation paths: /webhooks: get: tags: - Webhooks summary: List registered webhooks operationId: listWebhooks responses: '200': description: All webhooks registered for the customer. content: application/json: schema: type: array items: $ref: '#/components/schemas/Webhook' components: schemas: Webhook: type: object properties: id: type: string description: Unique ID for the webhook. webhook_url: type: string format: uri is_active: type: boolean has_secret: type: boolean description: >- Whether a signing secret is configured. The secret itself is never returned. status: type: string enum: - active - failing - disabled description: >- Derived health: `disabled` when inactive, `failing` when the last delivery returned a non-2xx status, otherwise `active`. last_delivery_at: type: string format: date-time nullable: true description: Timestamp of the most recent delivery attempt, or null if none. last_delivery_status: type: integer nullable: true description: >- HTTP status code of the most recent delivery attempt, or null if none. events: type: array items: type: string enum: - cdd_state_changed - monitoring_alert_fired - cdd_document_fetched - search_completed - alert_remediated - flow_run_completed - flow_run_failed securitySchemes: xApiKey: type: apiKey name: X-API-KEY in: header ````