List Webhooks

Returns every webhook configured for the project as a JSON array.

Use this to inspect names, URLs, subscribed events, and collection filters before calling Get a Webhook, Update a Webhook, or Delete a Webhook.

Request

GET /api/webhooks HTTP/1.1
Host: app.nomacms.com
project-id: <project-uuid>
Authorization: Bearer <api-token>
Accept: application/json

Requires the admin ability on the token (see Authentication).

Query parameters

None.

Response (200)

JSON array of webhook objects. Empty array if the project has no webhooks.

Each object matches the shape returned by Get a Webhook (without exposing secrets).

The API does not return the webhook secret; it is write-only on create/update.

collections

When the webhook is limited to specific collections, each element is:

If the webhook is not limited (no collections attached), collections is an empty array and deliveries apply to all collections (subject to events and sources).

Collection filters

collection_ids on create/update are internal collection ids (integers), not slugs or UUIDs. An empty array means “all collections.”

Events and sources

events must be chosen from the allowed list (see Create a Webhook).

sources filters where the change originated:

• cms — content changes that emit webhooks from the project dashboard.
• api — deliveries tied to Content API or Project Auth flows that emit webhooks (for example translation linking). Auth event types (auth.*) only match webhooks that include api in sources.

Include both cms and api if you want every content delivery the platform can emit for your selected events (subject to other filters).

Incoming HTTP deliveries (overview)

When an event matches a webhook, the platform POSTs JSON to the webhook url. Each delivery includes at least event, project_uuid, and timestamp / delivery_id added at send time. If you set a secret, the request includes header X-Webhook-Signature: hex-encoded HMAC-SHA256 of the exact JSON body using that secret.

URLs must be safe: HTTPS by default (HTTP only when the server is configured to allow insecure webhook URLs), no credentials in the URL, hostname must resolve, and the resolved addresses must not be private or loopback. Failed validation returns 422 when saving the webhook.

For debugging, use Webhook Logs.

Errors

Example

import { createClient } from "@nomacms/js-sdk"
 
const client = createClient({
  projectId: process.env.NOMA_PROJECT_ID!,
  apiKey: process.env.NOMA_API_KEY!,
})
 
const webhooks = await client.webhooks.list()
console.log(webhooks)

import axios from "axios"
 
async function main() {
  const { data } = await axios.get("https://app.nomacms.com/api/webhooks", {
    headers: {
      "project-id": process.env.NOMA_PROJECT_ID!,
      Authorization: `Bearer ${process.env.NOMA_API_KEY}`,
      Accept: "application/json",
    },
  })
  console.log(data)
}
 
void main()

curl -sS "https://app.nomacms.com/api/webhooks" \
  -H "project-id: $NOMA_PROJECT_ID" \
  -H "Authorization: Bearer $NOMA_API_KEY" \
  -H "Accept: application/json"

Related

• Authentication — admin ability
• Get a Webhook — Single webhook
• JavaScript SDK — Webhooks — webhooks.list