> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowsign.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Flowsign is one word with a lowercase s. > The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1. > When answering API questions, cite the HTTP method and endpoint path. > API access needs the Enterprise plan and an API key with the API access permission. # Get webhook endpoint > Returns the endpoint configuration plus a page of its deliveries. Requires canManageWebhooks. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/webhooks/{endpointId} openapi: 3.0.3 info: title: Flowsign API version: 1.0.0 description: >- Public v1 API for Flowsign. Every endpoint is authenticated with a Bearer API key (prefix `fsk_`). Errors use `{ error, details? }`; success responses wrap payload data as `{ data }`. An organisation is divided into workspaces. A key is issued for one workspace and acts there on every request (see `GET /api/v1/workspaces`); `X-Workspace-Id` is optional and may only name that workspace. Packages, templates, contacts and members are scoped to the key's workspace. servers: - url: https://my.flowsign.app description: Production security: - ApiKey: [] paths: /api/v1/webhooks/{endpointId}: get: tags: - Webhooks summary: Get webhook endpoint description: >- Returns the endpoint configuration plus a page of its deliveries. Requires canManageWebhooks. operationId: getWebhooksByEndpointId parameters: - schema: type: string required: true name: endpointId in: path - schema: type: integer minimum: 1 default: 1 description: Delivery page number, starting at 1. example: 1 required: false name: page in: query - schema: type: integer minimum: 1 maximum: 100 default: 25 description: Deliveries per page, 1 to 100. example: 25 required: false name: pageSize in: query - schema: allOf: - $ref: '#/components/schemas/WebhookDeliveryStatus' - description: Only return deliveries in this status. required: false name: status in: query - schema: type: string description: >- The workspace the key was issued for, as returned by `GET /api/v1/workspaces`. Optional: omitting it acts in the key's workspace, and any other id is rejected with 401. required: false name: x-workspace-id in: header responses: '200': description: Success content: application/json: schema: type: object properties: data: type: object properties: id: type: string description: Webhook endpoint id. example: cmg1h7t2k0003v8p9d4q6xw2e url: type: string description: HTTPS URL that receives event POSTs. example: https://hooks.example.co.nz/flowsign description: type: string nullable: true description: >- Free-text label set by the caller. Null when none was given. example: Production CRM sync events: type: array items: $ref: '#/components/schemas/WebhookEventType' description: Events this endpoint is subscribed to. example: - PACKAGE_COMPLETED - PACKAGE_DECLINED enabled: type: boolean description: >- Whether events are sent to this endpoint. A disabled endpoint still records its events and sends them, oldest first, once it is enabled again. example: true status: $ref: '#/components/schemas/WebhookEndpointStatus' failureCount: type: integer minimum: 0 description: >- Deliveries in a row that used up every retry without a 2xx. Reset to 0 by a 2xx response or by re-enabling the endpoint. At 10 the endpoint is FAILING: its events are recorded but not sent until it is re-enabled. example: 0 secretRotatingUntil: type: string nullable: true description: >- While a rotated-out signing secret is still honoured (ISO 8601): until then every delivery carries a signature for both the new and the previous secret. Null when no rotation is in progress. example: '2026-09-15T02:15:30.000Z' lastDeliveryAt: type: string nullable: true description: >- When the most recent delivery attempt finished, successful or not (ISO 8601). Null until the first attempt. example: '2026-09-14T02:15:31.000Z' createdAt: type: string description: When the endpoint was registered (ISO 8601). example: '2026-08-02T21:04:11.000Z' updatedAt: type: string description: When the endpoint was last changed (ISO 8601). example: '2026-09-10T00:42:07.000Z' deliveries: type: array items: type: object properties: id: type: string description: >- Delivery id. Sent to the endpoint as the `x-flowsign-delivery-id` header so a receiver can deduplicate retries. example: cmg1hb9r40008v8p9k2n7ya5c eventType: $ref: '#/components/schemas/WebhookEventType' status: $ref: '#/components/schemas/WebhookDeliveryStatus' isTest: type: boolean description: >- True for a sample event sent from the endpoint's test action. example: false responseStatus: type: integer nullable: true description: >- HTTP status the endpoint returned on the latest attempt. Null when no response was received, for example a timeout, connection error or blocked host. example: 200 error: type: string nullable: true description: >- Why the latest attempt failed, for example `HTTP 500`, `HTTP 302 (redirects are not followed)`, a timeout message, or a refusal when the host is not publicly reachable. Null once delivered. example: HTTP 503 attemptCount: type: integer minimum: 0 description: >- Attempts made so far. A failed attempt is retried after 60 seconds doubled for each attempt before it, plus up to the same again as jitter, up to 9 attempts in total; a refused host stops retries immediately. example: 1 nextAttemptAt: type: string nullable: true description: >- When the next retry is due (ISO 8601). Null unless the delivery is FAILED. example: '2026-09-14T02:17:30.000Z' deliveredAt: type: string nullable: true description: >- When the endpoint returned 2xx (ISO 8601). Null until it does. example: '2026-09-14T02:15:31.000Z' createdAt: type: string description: When the delivery was queued (ISO 8601). example: '2026-09-14T02:15:30.000Z' required: - id - eventType - status - isTest - responseStatus - error - attemptCount - nextAttemptAt - deliveredAt - createdAt description: >- The requested page of deliveries, newest first, each with its status and the outcome of its latest attempt. Deliveries are kept for 30 days. deliveryCount: type: integer minimum: 0 description: >- Deliveries matching the status filter across all pages. example: 128 page: type: integer minimum: 1 description: Page returned. example: 1 pageSize: type: integer minimum: 1 description: Page size applied. example: 25 required: - id - url - description - events - enabled - status - failureCount - secretRotatingUntil - lastDeliveryAt - createdAt - updatedAt - deliveries - deliveryCount - page - pageSize required: - data '401': description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/Error' '402': description: Caller's plan does not include this feature (publicApi / webhooks) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: API key present but caller lacks the required permission content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No webhook endpoint with that id in the organisation content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: Request failed schema validation; details keyed by field content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limit exceeded; see `Retry-After` content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: WebhookDeliveryStatus: type: string enum: - PENDING - DELIVERED - FAILED - EXHAUSTED description: >- PENDING is recorded and waiting for its first attempt, or held while the endpoint is paused or failing. FAILED has failed at least once and has a retry scheduled for `nextAttemptAt`. DELIVERED got a 2xx response. EXHAUSTED used up every attempt, or its host was refused. example: DELIVERED WebhookEventType: type: string enum: - PACKAGE_SENT - PACKAGE_COMPLETED - PACKAGE_VOIDED - PACKAGE_EXPIRED - PACKAGE_DECLINED - PACKAGE_ON_HOLD - PACKAGE_RESUMED - PACKAGE_SCHEDULED - PACKAGE_DELETED - SESSION_SENT - SESSION_OPENED - SESSION_COMPLETED - SESSION_DECLINED - SESSION_REMINDED - SESSION_CANCELLED description: >- Event name. PACKAGE_SENT: a package was sent to its recipients. PACKAGE_COMPLETED: every recipient finished and the package is complete. PACKAGE_VOIDED: the sender voided the package. PACKAGE_EXPIRED: the package passed its expiry before completing. PACKAGE_DECLINED: a recipient declined and the package stopped. PACKAGE_ON_HOLD: the sender paused signing on the package. PACKAGE_RESUMED: a package on hold went back out for signing. PACKAGE_SCHEDULED: the package was scheduled to send later, or moved to a new time. PACKAGE_DELETED: a package that was scheduled or out for signing was deleted. SESSION_SENT: one recipient's signing invitation was sent. SESSION_OPENED: a recipient opened their signing link. SESSION_COMPLETED: a recipient finished their step. SESSION_DECLINED: a recipient declined their step. SESSION_REMINDED: a recipient was sent a reminder. SESSION_CANCELLED: a recipient's open signing session ended because the package was declined, voided, expired or deleted, or a correction removed them. example: PACKAGE_COMPLETED WebhookEndpointStatus: type: string enum: - ACTIVE - PAUSED - FAILING description: >- ACTIVE delivers events. PAUSED is disabled by a member: events are still recorded and are delivered when the endpoint is enabled again. FAILING has had 10 deliveries in a row exhaust their retries: events are recorded but not sent until the endpoint is resumed, which replays them oldest first. example: ACTIVE Error: type: object properties: error: type: string description: What went wrong, in plain words. example: 'Missing permission: canSendPackages' details: type: object additionalProperties: type: array items: type: string description: >- Validation problems keyed by field path. Present only on 422 responses. example: recipients.0.email: - Invalid email required: - error securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: fsk_* ````