Sinbad Partner API

{
  "webhooks": [
    {
      "webhookId": "wh_demo",
      "partnerId": "partner_demo",
      "integrationId": "integration_demo",
      "environment": "sinbad-staging-env",
      "url": "https://partner.example.com/events",
      "description": "Trade updates",
      "eventTypes": [
        "trade.created",
        "trade.updated",
        "trade.message.created"
      ],
      "apiVersion": "2026-10-22",
      "status": "pending_verification",
      "revision": 1,
      "verifiedAt": null,
      "createdAt": "2026-10-23T10:00:00.000Z",
      "updatedAt": "2026-10-23T10:00:00.000Z",
      "deletedAt": null,
      "overlapUntil": null,
      "signingKeyId": "key_demo"
    }
  ],
  "nextCursor": null
}

List webhook endpoints.

Credential: Partner secret

Before you call

A server-side partner secret for the owning partner. Do not send an Origin header.
An active integration that your partner credential permits.

List live endpoints for one authorized integration

Server-only partner credential access: a 403 means the integration is unauthorized or inactive. Mutations share 60/min per partner; test and replay allow 5/min each per endpoint, rotation 1/min per endpoint. Only committed changes count; identical idempotent replays within 24 hours do not. A 429 includes retryAfter. Conflict details.kind can include IDEMPOTENCY_CONFLICT, ENDPOINT_DELETED, ENDPOINT_LIMIT, REVISION_CONFLICT, VERIFICATION_REQUIRED, ROTATION_IN_PROGRESS or REPLAY_UNAVAILABLE. Webhook availability depends on environment readiness; confirm it with Sinbad.

Webhook delivery must be available in the selected environment. Confirm readiness with Sinbad.

Errors

Status	Code	What to do
400	`VALIDATION_ERROR`	Correct the fields reported in details before retrying.
401	`UNAUTHENTICATED`	Create a new customer session or use a valid server credential.
403	`FORBIDDEN`	Use a server credential permitted for this active integration.
404	`NOT_FOUND`	Check the resource ID. A resource that belongs to someone else also returns 404.
409	`CONFLICT`	Read the current state again before you prepare or retry.
429	`RATE_LIMITED`	Wait for Retry-After before retrying.
503	`UPSTREAM_ERROR`	Retry with backoff; preserve the same idempotency key for a repeated mutation.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Query parameters

integrationIdstringRequiredformat: "^[A-Za-z0-9_-]{1,128}$"

limitintegerOptional1-100Defaults to 20

cursorstringOptional<=2048 characters

Response headers

Cache-ControlstringOptional

no-store

Response

Success

webhookslist of objects

nextCursorstring or null

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

409

Conflict Error

429

Too Many Requests Error

503

Service Unavailable Error