> ## Documentation Index > Fetch the complete documentation index at: https://v2.docs.conduit.financial/llms.txt > Use this file to discover all available pages before exploring further. # List available webhook event types > Returns all event types that can be subscribed to when creating a webhook endpoint, plus the signature metadata every delivery is signed with. ## OpenAPI ````yaml https://api.sandbox.conduit.financial/v2/api-docs/openapi.json get /webhooks/event-types openapi: 3.0.0 info: title: Conduit Sandbox API description: >- **Sandbox API** — clients integrate against this surface to exercise happy and unhappy paths without consuming real KYC/PSP credits or moving real money. Customer KYC, banking partners, and crypto custody are stubbed; org-level KYB runs against real providers. Simulation endpoints under `/v2/sandbox/*` drive specific scenarios. Internal and portal endpoints are excluded from this spec. version: '2.0' contact: {} servers: - url: https://api.sandbox.conduit.financial/v2 description: Sandbox - url: https://api.conduit.financial/v2 description: Production security: - api-key: [] tags: - name: Customers - name: Registered Addresses - name: Wallets - name: Wallet Signers - name: Signing Quorum - name: Virtual Accounts - name: Applications - name: Documents - name: Verifications - name: Signing Requests - name: Transactions - name: Payouts - name: Whitelist Recipients - name: Orders - name: RFIs - name: Webhook Endpoints - name: Webhook Deliveries - name: Webhook Event Types - name: Features - name: Customer Onboarding - name: Sandbox paths: /webhooks/event-types: get: tags: - Webhook Event Types summary: List available webhook event types description: >- Returns all event types that can be subscribed to when creating a webhook endpoint, plus the signature metadata every delivery is signed with. operationId: WebhookEventTypesController_listEventTypes_v2 parameters: [] responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/WebhookEventTypeListResponseDto' '400': description: >- **INVALID_OID_FORMAT**: A path or query parameter expected a valid object identifier but received a value that does not match the expected format. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorDto' example: type: INVALID_OID_FORMAT title: Invalid Object ID Format status: 400 detail: >- A path or query parameter expected a valid object identifier but received a value that does not match the expected format. resolution: >- Verify that all IDs in the request URL and query parameters are correctly formatted. IDs are typically prefixed strings like 'cus_...', 'app_...', or 'doc_...'. docs: https://conduit-v2.mintlify.app/errors#invalid-oid-format instance: /v2/... correlationId: req_a1b2c3d4 timestamp: '2026-01-15T09:30:00.000Z' '401': description: >- **API_KEY_MISSING**: The request did not include an API key. All API requests must be authenticated. **API_KEY_INVALID**: The provided API key is not recognized or has been revoked. content: application/json: schema: $ref: '#/components/schemas/ProblemDetailDto' example: type: API_KEY_MISSING title: API Key Missing status: 401 detail: >- The request did not include an API key. All API requests must be authenticated. resolution: >- Include your API key in the 'x-api-key' header with every request. docs: https://conduit-v2.mintlify.app/errors#api-key-missing instance: /v2/... correlationId: req_a1b2c3d4 timestamp: '2026-01-15T09:30:00.000Z' '429': description: >- **RATE_LIMITED**: Too many requests. This error is returned by three independent checks: the per-organization bucket applied to every authenticated API request; the per-IP bucket applied to unauthenticated traffic before an API key is validated; and the per-IP bucket applied when repeated invalid API keys are submitted from the same address. Honor the Retry-After header (also exposed as retryAfterSeconds in the body) before retrying. Current limits and remaining budget are visible in X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on rate-limited route responses. content: application/json: schema: $ref: '#/components/schemas/RateLimitedErrorDto' example: type: RATE_LIMITED title: Rate Limited status: 429 detail: >- Too many requests. This error is returned by three independent checks: the per-organization bucket applied to every authenticated API request; the per-IP bucket applied to unauthenticated traffic before an API key is validated; and the per-IP bucket applied when repeated invalid API keys are submitted from the same address. Honor the Retry-After header (also exposed as retryAfterSeconds in the body) before retrying. Current limits and remaining budget are visible in X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on rate-limited route responses. resolution: >- Sleep until Retry-After seconds have elapsed, then retry. For sustained workloads exceeding the per-organization defaults, request a rate-limit increase through your support contact. docs: https://conduit-v2.mintlify.app/errors#rate-limited instance: /v2/... correlationId: req_a1b2c3d4 timestamp: '2026-01-15T09:30:00.000Z' retryAfterSeconds: 3 '500': description: >- **INTERNAL_ERROR**: An unexpected error occurred while processing your request. content: application/json: schema: $ref: '#/components/schemas/ProblemDetailDto' example: type: INTERNAL_ERROR title: Internal Error status: 500 detail: An unexpected error occurred while processing your request. resolution: >- Retry the request after a brief delay. If the error persists, contact support and include the correlationId from the error response for investigation. docs: https://conduit-v2.mintlify.app/errors#internal-error instance: /v2/... correlationId: req_a1b2c3d4 timestamp: '2026-01-15T09:30:00.000Z' components: schemas: WebhookEventTypeListResponseDto: type: object properties: data: type: array items: type: object properties: eventType: type: string description: Event type identifier used when subscribing to events example: application.approved description: type: string description: Human-readable description of when this event fires example: Fired when a customer onboarding application is approved category: type: string enum: - onboarding - transaction - wallet - admin - whitelist - compliance description: >- Domain bucket for this event. Lets integrators wire one handler per concern without parsing the dotted event name. lifecycle: type: string enum: - stable - beta - deprecated description: >- Stability of this event type. `stable` events have a contract you can build against; `beta` may change shape; `deprecated` will be removed in a future major version. exampleData: type: object additionalProperties: {} description: Example data block for this event type, shape varies per event required: - eventType - description - category - lifecycle - exampleData description: >- All subscribable event types. Use the `eventType` value verbatim in `subscription.eventTypes` when creating a `selected`-mode endpoint. signature: type: object properties: algorithm: type: string description: >- Algorithm used to sign webhook deliveries. Verify with `crypto.createHmac('sha256', secret)`. enum: - hmac-sha256 headerName: type: string description: >- Name of the HTTP header carrying the signature on every delivery. enum: - X-Conduit-Signature headerFormat: type: string description: >- Header value format. `t` is the unix epoch in seconds when the delivery was signed; each `v1` is a hex-encoded HMAC digest. Deliveries normally carry one `v1`. During a signing-secret rotation grace window the header carries multiple comma-separated `v1=` segments — one per currently-valid secret (new and previous). Verify by recomputing the digest for your secret and accepting if it matches ANY `v1` segment. enum: - t=,v1=[,v1=] signedPayloadFormat: type: string description: >- Canonical form fed to the HMAC: the unix timestamp, a literal `.`, then the raw request body. Verify by recomputing this against the header `t` and comparing the digest. enum: - . secretFormat: type: string description: >- Per-endpoint signing secret format: the literal prefix `whsec_` followed by 64 lowercase hex characters. The FULL string, including the `whsec_` prefix, is the HMAC-SHA256 key — do NOT strip the prefix before passing the secret to `crypto.createHmac`. Stripping the prefix produces a different digest and every valid delivery looks indistinguishable from signature tampering (silent rejection, no diagnostic). enum: - whsec_<64-hex> required: - algorithm - headerName - headerFormat - signedPayloadFormat - secretFormat additionalProperties: false description: >- Signature verification metadata. Same constants apply to every webhook delivery; signing secrets are per-endpoint. required: - data - signature ValidationErrorDto: type: object properties: type: type: string description: Machine-readable error code example: CUSTOMER_NOT_FOUND title: type: string description: Human-readable error type label example: Customer Not Found status: type: number description: HTTP status code example: 404 detail: type: string description: Human-readable explanation of this occurrence example: Customer with id cus_abc123 not found resolution: type: string description: What the developer should do to resolve this error example: >- Verify the customer ID. Check you are using the correct API key for this organization. docs: type: string description: URL to error documentation example: https://conduit-v2.mintlify.app/errors#customer-not-found instance: type: string description: Request path that produced the error example: /v2/customers/cus_abc123 correlationId: description: Request correlation ID example: req_a1b2c3d4 type: string timestamp: type: string description: ISO 8601 UTC timestamp example: '2026-04-27T20:00:00.000Z' details: description: >- Additional structured data for domain-specific errors (e.g. missing field lists, pair info) errors: type: array items: type: object properties: pointer: type: string description: JSON pointer to the invalid field example: /email detail: type: string description: What is wrong with this field example: Invalid email format allowedValues: description: The values this field accepts, when it is a closed set example: - ach - fedwire - rtp type: array items: type: string category: description: >- Class of blocker (requirements-validator output only). 'field' = form-field gap, 'document' = missing or insufficient document (including per-UBO document slots), 'individual' = required person missing. example: field type: string enum: - field - document - individual required: - pointer - detail required: - type - title - status - detail - resolution - docs - instance - timestamp ProblemDetailDto: type: object properties: type: type: string description: Machine-readable error code example: CUSTOMER_NOT_FOUND title: type: string description: Human-readable error type label example: Customer Not Found status: type: number description: HTTP status code example: 404 detail: type: string description: Human-readable explanation of this occurrence example: Customer with id cus_abc123 not found resolution: type: string description: What the developer should do to resolve this error example: >- Verify the customer ID. Check you are using the correct API key for this organization. docs: type: string description: URL to error documentation example: https://conduit-v2.mintlify.app/errors#customer-not-found instance: type: string description: Request path that produced the error example: /v2/customers/cus_abc123 correlationId: description: Request correlation ID example: req_a1b2c3d4 type: string timestamp: type: string description: ISO 8601 UTC timestamp example: '2026-04-27T20:00:00.000Z' details: description: >- Additional structured data for domain-specific errors (e.g. missing field lists, pair info) required: - type - title - status - detail - resolution - docs - instance - timestamp RateLimitedErrorDto: type: object properties: type: type: string description: Machine-readable error code example: CUSTOMER_NOT_FOUND title: type: string description: Human-readable error type label example: Customer Not Found status: type: number description: HTTP status code example: 404 detail: type: string description: Human-readable explanation of this occurrence example: Customer with id cus_abc123 not found resolution: type: string description: What the developer should do to resolve this error example: >- Verify the customer ID. Check you are using the correct API key for this organization. docs: type: string description: URL to error documentation example: https://conduit-v2.mintlify.app/errors#customer-not-found instance: type: string description: Request path that produced the error example: /v2/customers/cus_abc123 correlationId: description: Request correlation ID example: req_a1b2c3d4 type: string timestamp: type: string description: ISO 8601 UTC timestamp example: '2026-04-27T20:00:00.000Z' details: description: >- Additional structured data for domain-specific errors (e.g. missing field lists, pair info) retryAfterSeconds: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 description: Seconds to wait before retrying example: 3 required: - type - title - status - detail - resolution - docs - instance - timestamp - retryAfterSeconds securitySchemes: api-key: type: apiKey in: header name: x-api-key ````