Description
crates/api/src/routes/webhooks.rs only exposes POST (create) — there is no way to list a wallet's already-registered webhook endpoints via the API at all, even though Store::active_webhook_endpoints already exists and is used internally by WebhookSender::dispatch. An integrator who registered a webhook weeks ago and forgot the exact URL (or wants to confirm how many endpoints they've registered) currently has no way to check via the API.
Requirements and Context
- Add
GET /v1/wallets/:id/webhooks, authorized via authorize_wallet (same as create), returning each endpoint's id, url, active status, and created_at — never the secret (unlike the creation response, which does return it once; this is a read of already-registered endpoints, and re-exposing the secret on every list call would defeat the point of only returning it once).
Suggested Execution
Branch: feat/api/list-webhook-endpoints-route
Implement Changes
- Add a
WebhookListView struct (mirroring WebhookView but omitting secret) and a list_webhooks handler to crates/api/src/routes/webhooks.rs, reusing Store::active_webhook_endpoints (or add an unfiltered variant if inactive/deactivated endpoints should also be listed — decide and justify in the PR description).
- Register the route in
crates/api/src/lib.rs::build_router.
Test and Commit
list_webhooks_returns_registered_endpoints_without_the_secret.list_webhooks_on_unowned_wallet_is_404.list_webhooks_on_a_wallet_with_no_endpoints_returns_an_empty_list.- Run
cargo test -p octo-api locally before committing.
Example Commit Message
feat(api): add GET /v1/wallets/:id/webhooks to list registered endpoints
Webhook endpoints could be created but never listed back through the API.
Adds a read-only listing route that deliberately omits the signing secret
(which is only ever returned once, at creation time) to avoid re-exposing it
on every subsequent read.
Guidelines
- Double-check the response struct genuinely omits
secret — copy-pasting WebhookView without removing the field would silently reintroduce a secret-leak on every list call.
- Reference this issue with
Closes #<issue-number> in the PR description.
Description
crates/api/src/routes/webhooks.rsonly exposesPOST(create) — there is no way to list a wallet's already-registered webhook endpoints via the API at all, even thoughStore::active_webhook_endpointsalready exists and is used internally byWebhookSender::dispatch. An integrator who registered a webhook weeks ago and forgot the exact URL (or wants to confirm how many endpoints they've registered) currently has no way to check via the API.Requirements and Context
GET /v1/wallets/:id/webhooks, authorized viaauthorize_wallet(same as create), returning each endpoint'sid,url,activestatus, andcreated_at— never thesecret(unlike the creation response, which does return it once; this is a read of already-registered endpoints, and re-exposing the secret on every list call would defeat the point of only returning it once).Suggested Execution
Branch:
feat/api/list-webhook-endpoints-routeImplement Changes
WebhookListViewstruct (mirroringWebhookViewbut omittingsecret) and alist_webhookshandler tocrates/api/src/routes/webhooks.rs, reusingStore::active_webhook_endpoints(or add an unfiltered variant if inactive/deactivated endpoints should also be listed — decide and justify in the PR description).crates/api/src/lib.rs::build_router.Test and Commit
list_webhooks_returns_registered_endpoints_without_the_secret.list_webhooks_on_unowned_wallet_is_404.list_webhooks_on_a_wallet_with_no_endpoints_returns_an_empty_list.cargo test -p octo-apilocally before committing.Example Commit Message
Guidelines
secret— copy-pastingWebhookViewwithout removing the field would silently reintroduce a secret-leak on every list call.Closes #<issue-number>in the PR description.