GET

List webhook signing keys

Lists all webhook signing keys registered for an enterprise.

Authorization: Caller must be an admin of the specified enterprise.

Returns key metadata only — actual public key material and JWK data are not included in the response.

Path Params

enterpriseId string required

The enterprise ID.

Query Params

status string enum

Filter by key status.

ACTIVEREVOKED
limit integer

Maximum number of results per page. Default 50, maximum 100.

>= 1 · <= 100

Defaults to 50
prevId integer

Pagination offset. Default 0.

>= 0

Defaults to 0

Responses

200

A paginated list of webhook signing keys.

Response Body

object

Paginated list of webhook signing keys for an enterprise.

keys array of objects required
keys object
- id string uuid required
  
  Internal UUID of the key.
- keyId string required
  
  Customer-provided key identifier.
- keyName string required
  
  Human-readable name for the key.
- algorithm string enum nullable
  
  The signing algorithm (EdDSA or ECDSA). Null for JWKS URI registrations.
  
  EdDSAECDSA
- status string enum required
  
  Current status of the key.
  
  ACTIVEREVOKED
- createdDate string date-time required
  
  When the key was registered.
- createdBy string required
  
  User who registered the key.
total integer int64 required

Total number of keys matching the query.
limit integer required

Maximum results per page.
prevId integer required

The pagination offset used in this request.

400

Bad Request

Response Body

ONE OF

code string
message string
status integer

code string
message string
status integer
failedValidations object

401

Unauthorized

Response Body

object

code string
message string
status integer

403

Forbidden

Response Body

object

code string
message string
status integer

404

The specified resource was not found

Response Body

object

code string
message string
status integer

500

Server Error - Transient error please try again

Response Body

object

code string
message string
status integer

curl --request GET \ --url 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys&status=ACTIVE?limit=50&prevId=0' \ --header 'accept: application/json' \ --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

const url = 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys&status=ACTIVE?limit=50&prevId=0'; const options = {method: 'GET', headers: {accept: 'application/json', 'Authorization': 'Bearer YOUR_ACCESS_TOKEN'}}; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err));

require 'uri' require 'net/http' url = URI("https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys&status=ACTIVE?limit=50&prevId=0") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["accept"] = 'application/json' request["Authorization"] = 'Bearer YOUR_ACCESS_TOKEN' response = http.request(request) puts response.read_body

<?php require_once('vendor/autoload.php'); $client = new \GuzzleHttp\Client(); $response = $client->request('GET', 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys&status=ACTIVE?limit=50&prevId=0', [ 'headers' => [ 'accept' => 'application/json', 'Authorization' => 'Bearer YOUR_ACCESS_TOKEN', ], ]); echo $response->getBody();

import requests url = "https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/keys&status=ACTIVE?limit=50&prevId=0" headers = { "accept": "application/json", "Authorization": "Bearer YOUR_ACCESS_TOKEN" } response = requests.get(url, headers=headers) print(response.text)

{ "keys": [ { "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", "keyId": "customer-prod-key-2026", "keyName": "Production Webhook Key", "algorithm": "EdDSA", "status": "ACTIVE", "createdDate": "2026-01-12T10:30:00Z", "createdBy": "user@example.com" } ], "total": 1, "limit": 50, "prevId": 0 }