> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# List webhooks

> Requires integrations:read.



## OpenAPI

````yaml /api-reference/openapi-public.json get /webhooks
openapi: 3.0.3
info:
  description: >-
    The API your own systems use: place and follow calls, have an AI agent call
    someone, run campaigns and get their results, keep contacts in step with
    your CRM, and receive signed webhooks. Authenticate with an integration key
    (Authorization: Bearer ft_...), used only from the IP addresses it allows.
  title: FireTone API
  version: 0.1.0
servers:
  - description: Your platform's API host
    url: https://{host}/api/v1
    variables:
      host:
        default: api.firet.one
security:
  - bearerAuth: []
tags:
  - name: Auth
  - description: >-
      Live calls and what can be done to them: hang up, hold, transfer, park,
      merge, monitor, whisper; the Desk's own call.
    name: Calls
  - description: 'Outbound campaigns: contacts, attempts, outcomes.'
    name: Campaigns
  - description: 'Customers: who called, what is known about them, and their memory.'
    name: Contacts
  - description: What was said on an AI call, and the review of it.
    name: Conversations
  - description: >-
      Your own systems: HTTP connections an IVR calls mid-call, and webhooks for
      call events. Tenant URLs must be public https addresses.
    name: Integrations
  - name: Live
  - name: Provisioning
  - name: Reporting
  - description: Tickets raised by people, agents and the API.
    name: Tickets
  - description: Messages left for an extension or a queue.
    name: Voicemail
paths:
  /webhooks:
    get:
      tags:
        - Integrations
      summary: List webhooks
      description: Requires integrations:read.
      operationId: getWebhooks
      parameters:
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/sort'
        - $ref: '#/components/parameters/order'
        - $ref: '#/components/parameters/q'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookPage'
          description: OK
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  parameters:
    limit:
      in: query
      name: limit
      schema:
        default: 50
        maximum: 500
        type: integer
    offset:
      in: query
      name: offset
      schema:
        default: 0
        type: integer
    sort:
      description: >-
        Sort key. Each list accepts its own allow-list of keys, given in that
        endpoint's description; anything else is a 400. ORDER BY cannot be
        parameterised, so the key is looked up rather than interpolated. Every
        sort carries a tiebreak on the primary key, so paging stays disjoint
        when the sort column has duplicates.
      in: query
      name: sort
      schema:
        type: string
    order:
      description: >-
        Sort direction. Defaults to ascending, except the call log, which reads
        newest first.
      in: query
      name: order
      schema:
        enum:
          - asc
          - desc
        type: string
    q:
      description: >-
        Free-text search across the list's searchable columns (case-insensitive
        substring). % and _ in the term match themselves.
      in: query
      name: q
      schema:
        type: string
  schemas:
    WebhookPage:
      properties:
        items:
          items:
            $ref: '#/components/schemas/Webhook'
          type: array
        limit:
          type: integer
        offset:
          type: integer
        total:
          type: integer
      type: object
    Webhook:
      description: >-
        Call events posted to your URL. Every request carries
        X-FireTone-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "t.body")>,
        X-FireTone-Event and X-FireTone-Delivery. Header values and the secret
        are never returned.
      properties:
        created_at:
          format: date-time
          type: string
        disabled_reason:
          description: Why the webhook was switched off. Switching it back on clears it.
          nullable: true
          type: string
        enabled:
          type: boolean
        events:
          items:
            enum:
              - call.started
              - call.ringing
              - call.answered
              - call.ended
              - call.missed
              - voicemail.received
              - recording.ready
              - conversation.completed
              - callback.requested
              - ticket.created
              - ticket.updated
              - contact.created
              - campaign.contact.completed
              - campaign.completed
              - csat.submitted
            type: string
          type: array
        failing_since:
          description: >-
            Deliveries have failed without a success since then; three days of
            it switches the webhook off.
          format: date-time
          nullable: true
          type: string
        header_names:
          items:
            type: string
          type: array
        id:
          format: uuid
          type: string
        name:
          type: string
        organisation_id:
          format: uuid
          type: string
        secret:
          description: >-
            The signing secret. Only on the create and rotate responses: shown
            once.
          type: string
        updated_at:
          format: date-time
          type: string
        url:
          type: string
      type: object
    Error:
      properties:
        error:
          properties:
            code:
              enum:
                - invalid_request
                - invalid_credentials
                - unauthenticated
                - forbidden
                - not_found
                - conflict
                - internal
              type: string
            message:
              type: string
          required:
            - code
            - message
          type: object
      required:
        - error
      type: object
  responses:
    Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
      description: Outside the caller's scope, or insufficient role
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or API key
      description: >-
        Every request sends `Authorization: Bearer <token>`. The token is either
        a panel session (a JWT from /auth/login, 12 hours) or an API key
        `ft_<id>_<secret>`. An API key is accepted only from an address on its
        IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required
        for an old key that has none), is limited to its rate per minute (429
        rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on
        every response), and at most 60 call placements a minute.
      scheme: bearer
      type: http

````