> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zebratruth.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List saved webhook endpoints

> Saved endpoints receive every matching event without a per-request `webhookUrl`.
**Dashboard session only**: the webhook management routes are not callable with an API
key (403 `permission_not_granted`), and require the Pro plan
(403 `entitlement_required`). Per-request `webhookUrl` on a check is unaffected and
works on every plan. Secrets are never returned here.




## OpenAPI

````yaml /openapi/zebratruth-v1.yaml get /webhooks
openapi: 3.1.0
info:
  title: ZebraTruth Compliance API
  version: 1.0.0
  description: >
    AI-powered compliance checking for advertising content. Check text and
    images against

    jurisdiction laws, platform policies, and rights clearance requirements.
    Results include

    embeddable annotations mapped to content locations (text spans, video
    timestamps, image regions).
  contact:
    name: ZebraTruth Support
    email: support@zebratruth.ai
    url: https://developers.zebratruth.ai
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
servers:
  - url: https://api.zebratruth.ai/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Video Compliance
    description: >
      **Primary endpoint.** Async compliance analysis for video ads. 3-step
      flow:

      get an upload URL, upload the video bytes, submit for analysis. Poll or

      receive an HMAC-signed webhook with the report. Returns timestamped

      findings citing stable evidence IDs (`audio_NNN`, `frame_NNN`, `ocr_NNN`,

      `signal_NNN`). 3-180 second videos. mp4 / webm /

      quicktime. Built for ad agencies and creators.
  - name: Authentication
    description: Validate API keys and check account status
  - name: Compliance
    description: >-
      Run compliance checks on text + image content (sync). For video, use the
      Video Compliance endpoints above.
  - name: Agents
    description: Discover and invoke individual compliance agents
  - name: Jobs
    description: Poll async job status and view execution traces
  - name: Reports
    description: Retrieve and replay compliance reports
  - name: Observability
    description: Request logs and webhook delivery status
  - name: Billing
    description: Subscriptions, plan changes, and credit balance
  - name: Documents
    description: Extract text from PDF and Word documents before or as part of a check
  - name: Check History
    description: List and retrieve past compliance checks for the workspace
  - name: Provenance
    description: Inspect and sign Content Credentials (C2PA) on images and video
  - name: Corpus
    description: >-
      Review queue for proposed changes to the governed legal corpus (dashboard
      session)
  - name: Webhooks
    description: Saved webhook endpoints (dashboard session) and delivery logs
paths:
  /webhooks:
    get:
      tags:
        - Webhooks
      summary: List saved webhook endpoints
      description: >
        Saved endpoints receive every matching event without a per-request
        `webhookUrl`.

        **Dashboard session only**: the webhook management routes are not
        callable with an API

        key (403 `permission_not_granted`), and require the Pro plan

        (403 `entitlement_required`). Per-request `webhookUrl` on a check is
        unaffected and

        works on every plan. Secrets are never returned here.
      operationId: listWebhooks
      responses:
        '200':
          description: Saved endpoints
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/WebhookEndpoint'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/ForbiddenCoded'
components:
  schemas:
    WebhookEndpoint:
      type: object
      properties:
        webhookId:
          type: string
          example: whk_0123456789abcdef
        url:
          type: string
          format: uri
        events:
          type: array
          items:
            type: string
        status:
          type: string
        createdAt:
          type: string
          format: date-time
    CodedError:
      type: object
      description: >
        Standard error envelope. `data.code` is the stable discriminator to
        branch on;

        `statusMessage` is the human-readable reason. Unless a response
        documents extra

        named fields, `data` is reduced to `{ code }` before it is sent.
      required:
        - statusCode
        - message
      properties:
        error:
          type: boolean
          example: true
        url:
          type: string
          format: uri
        statusCode:
          type: integer
        statusMessage:
          type: string
        message:
          type: string
        data:
          type: object
          required:
            - code
          properties:
            code:
              type: string
              example: review_scope_not_enabled
          additionalProperties: true
  responses:
    Unauthorized:
      description: |
        Invalid, missing, or expired API key. Standard error envelope —
        read `message` for the human-readable reason.
      content:
        application/json:
          schema:
            type: object
            description: Standard error envelope.
            required:
              - statusCode
              - message
            properties:
              error:
                type: boolean
                example: true
              url:
                type: string
                format: uri
                example: https://api.zebratruth.ai/v1/whoami
              statusCode:
                type: integer
                example: 401
              statusMessage:
                type: string
                example: Invalid API key
              message:
                type: string
                description: Canonical human-readable reason — pattern-match on this field.
                example: Invalid API key
    ForbiddenCoded:
      description: >
        The credential is valid but may not perform this action. `data.code` is
        one of

        `permission_not_granted`, `principal_forbidden_control_plane` (an API
        key called a

        dashboard-only action), `membership_not_active`, `entitlement_required`,

        `workspace_provisioning`, `workspace_deletion_scheduled`.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CodedError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: |
        API key starting with `zt_live_` (production) or `zt_test_` (sandbox).
        Get your key at https://developers.zebratruth.ai

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.