curl --request GET \
--url https://control.ergoly.ai/api/v1/webhooks \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://control.ergoly.ai/api/v1/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://control.ergoly.ai/api/v1/webhooks"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"data": [
{
"id": "f2e1d0c9-b8a7-4655-9243-1c0b9a8d7e6f",
"organizationId": "0d4c9f2e-4b8a-4a5b-9e21-6f9c2a1b7d30",
"workerId": "8f1c2d3e-9a4b-4c5d-8e6f-1a2b3c4d5e6f",
"clientId": null,
"workClientId": "c1a2b3c4-d5e6-4f70-8912-3a4b5c6d7e8f",
"name": "Deploy notifications",
"description": "Our CI posts here when a release finishes.",
"url": "https://api.ergoly.ai/api/hooks/f2e1d0c9-b8a7-4655-9243-1c0b9a8d7e6f",
"surface": {
"kind": "channel",
"channelId": "C0A1B2C3D4E",
"slackUserId": null
},
"threading": "top_level",
"taskId": "5d6e7f80-91a2-4b3c-8d4e-5f60718293a4",
"runMode": "overlap",
"keepMemory": false,
"threadTs": null,
"rootText": null,
"promptTemplate": null,
"enabled": true,
"createdBy": "api",
"lastDeliveredAt": "2026-03-04T11:02:31.000Z",
"revokedAt": null,
"createdAt": "2026-02-28T14:10:00.000Z",
"updatedAt": "2026-03-04T11:02:31.000Z"
}
],
"page": {
"limit": 50,
"hasMore": true,
"nextCursor": "MjAyNi0wMy0wNFQwOToxNDowMi4wMDBafDhmMWMyZDNlLTlhNGItNGM1ZC04ZTZmLTFhMmIzYzRkNWU2Zg"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}List webhooks
Every inbound endpoint your organization has, revoked ones included — a retired webhook keeps its row so its delivery history stays readable, and enabled: false beside a revokedAt is what says which. No response here carries a secret. ?workerId= narrows to one Worker.
curl --request GET \
--url https://control.ergoly.ai/api/v1/webhooks \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://control.ergoly.ai/api/v1/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://control.ergoly.ai/api/v1/webhooks"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text){
"data": [
{
"id": "f2e1d0c9-b8a7-4655-9243-1c0b9a8d7e6f",
"organizationId": "0d4c9f2e-4b8a-4a5b-9e21-6f9c2a1b7d30",
"workerId": "8f1c2d3e-9a4b-4c5d-8e6f-1a2b3c4d5e6f",
"clientId": null,
"workClientId": "c1a2b3c4-d5e6-4f70-8912-3a4b5c6d7e8f",
"name": "Deploy notifications",
"description": "Our CI posts here when a release finishes.",
"url": "https://api.ergoly.ai/api/hooks/f2e1d0c9-b8a7-4655-9243-1c0b9a8d7e6f",
"surface": {
"kind": "channel",
"channelId": "C0A1B2C3D4E",
"slackUserId": null
},
"threading": "top_level",
"taskId": "5d6e7f80-91a2-4b3c-8d4e-5f60718293a4",
"runMode": "overlap",
"keepMemory": false,
"threadTs": null,
"rootText": null,
"promptTemplate": null,
"enabled": true,
"createdBy": "api",
"lastDeliveredAt": "2026-03-04T11:02:31.000Z",
"revokedAt": null,
"createdAt": "2026-02-28T14:10:00.000Z",
"updatedAt": "2026-03-04T11:02:31.000Z"
}
],
"page": {
"limit": 50,
"hasMore": true,
"nextCursor": "MjAyNi0wMy0wNFQwOToxNDowMi4wMDBafDhmMWMyZDNlLTlhNGItNGM1ZC04ZTZmLTFhMmIzYzRkNWU2Zg"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}{
"error": {
"code": "unauthorized",
"message": "<string>",
"docs": "<string>"
}
}Authorizations
An organization-scoped API key, minted in control under Settings → API keys. Every failure to authenticate answers one identical 401: "Provide a valid organization-scoped API key or an active session." Each operation names the one scope it is filed under, <resource>:<read|write>, where the resource is the first path segment after /api/v1/; a key minted today carries all 22 of them. Scopes are RECORDED — on the key and on every audit row — and are not yet enforced: no request is refused for want of one.
Query Parameters
Narrow to one Worker. A malformed id is a 400; a well-formed id naming another organization's Worker answers an empty list.
Page size. Defaults to 50, clamped at 200. A value that is not a positive integer is a 400.
Opaque keyset cursor from the previous page's page.nextCursor. A cursor this API did not issue is a 400, never a silent page one.

