Skip to content
Savorum API

List library webhooks

GET
/api/v1/webhooks
curl --request GET \
  --url http://127.0.0.1:8080/api/v1/webhooks \
  --header 'Authorization: Bearer <token>'

Library owners manage this library’s subscriptions. Instance administrators manage instance security-event subscriptions through /instance-webhooks. Personal tokens cannot manage either. Destinations require HTTPS and public DNS addresses unless a deployment operator explicitly trusts a private CIDR. DNS is checked on each connection; up to three method-preserving HTTPS redirects are revalidated before following. Events contain IDs and minimal facts, never recipe bodies or credentials. Delivery is at least once. Receivers verify the exact body with HMAC-SHA256 over timestamp + ‘.’ + body using Savorum-Signature: t=,v1=, reject timestamps outside five minutes, then persistently deduplicate delivery_id. Savorum-Delivery-ID and Savorum-Event-ID also occur inside the signed body. Secrets appear once on create or rotate. Rotation immediately invalidates the old key for future attempts, including queued retries. Keep signing-key files with private instance backups. Retries cover network failures, 408, 429, and 5xx: up to eight attempts per cycle within 24 hours, exponential delay from 15 seconds with jitter, capped at one hour, honoring bounded Retry-After. Other statuses end the cycle. History retains up to 1000 finished deliveries per subscription for 30 days and 32 attempts per delivery. Repeated final failures automatically pause delivery; fix the receiver before re-enabling. Paused subscriptions retain queued work but do not subscribe to new events.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

OK

Media typeapplication/json
Array<object> | null
object
consecutive_failures
required
integer format: int64
created_at
required
string format: date-time
enabled
required
boolean
event_types
required
Array<string> | null
id
required
string
library_id
string
name
required
string
pause_reason
string
revision
required
integer format: int64
secret_rotated_at
required
string format: date-time
updated_at
required
string format: date-time
updated_by
required
string
url
required
string
key
additional properties
any
Examplegenerated
[
  {
    "consecutive_failures": 1,
    "created_at": "2026-04-15T12:00:00Z",
    "enabled": true,
    "event_types": [
      "example"
    ],
    "id": "example",
    "library_id": "example",
    "name": "example",
    "pause_reason": "example",
    "revision": 1,
    "secret_rotated_at": "2026-04-15T12:00:00Z",
    "updated_at": "2026-04-15T12:00:00Z",
    "updated_by": "example",
    "url": "example"
  }
]

401

Section titled “401”

No valid session or API token (authentication-required), or the credential sent is invalid (invalid-credentials).

Media typeapplication/problem+json
object
code
required
string
detail
required
string
status
required
integer format: int64
title
required
string
type
required
string
key
additional properties
any
Examplegenerated
{
  "code": "example",
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

default

Section titled “default”

Error

Media typeapplication/problem+json
object
code

Stable application error code; clients may also use the problem type suffix.

string
detail

A human-readable explanation specific to this occurrence of the problem.

string
errors

Optional list of individual error details

Array<object> | null
object
location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string
message

Error message text

string
value

The value at the given location

key
additional properties
any
instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri
params

Structured context for the stable error code.

object
key
additional properties
any
status

HTTP status code

integer format: int64
title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string
type

A URI reference to human-readable documentation for the error.

string format: uri
default: about:blank
violations
Array<object>
object
code
required
string
location
required
string
params
object
key
additional properties
any
key
additional properties
any
Example
{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}