011 audit webhook subscriptions: Flow PT REST recipe

Call

# get is FPT.get from src/sg_groundtruth/client.py; it adds auth and the /api/v1 prefix.
# The listing is site-wide: it returns every hook, not the ones this script created.
hooks = get("/webhook/hooks").json()["data"]

for h in hooks:
    # num_deliveries is the lifetime counter. The deliveries listing keeps seven days, so a hook
    # that last fired eight days ago returns an empty list and a non-zero count. Probe 045.
    ever = h["num_deliveries"]
    recent = get(f"/webhook/hooks/{h['id']}/deliveries").json()["data"]
    print(f"{h['status']:9s} {ever:>6} ever  {len(recent):>4} in 7d  "
          f"{sorted(h['entity_types'] or {}) or h.get('event_type')}  {h['url']}")

Response

{ "data": [ { "id": "<uuid>",
      "url": "https://<third-party host>/hook",
      "entity_types": { "Version": { "update": ["sg_status_list"] } },
      "status": "active", "projects": [], "num_deliveries": 0,
      "validate_ssl_cert": true, "batch_deliveries": true,
      "is_token_set": true, "name": "", "description": "" } ],
  "links": { "self": "/api/v1/webhook/hooks",
             "next": "/api/v1/webhook/hooks?page%5Bnumber%5D=2&page%5Bsize%5D=500" } }

On the probed site this returned 63 hooks, of which 61 were active with num_deliveries: 0, one disabled with 29, and one disabled with 0.

Notes

The listing is the whole site. A script with API access reads every other integration's consumer url, its entity_types and its project scoping. Treat the output as sensitive.
The secret token is never returned. is_token_set is the only readable fact about it.
num_deliveries: 0 on an active hook means it has never delivered in its lifetime, not that it is idle. That is the one field that separates a working subscription from a subscription that was accepted and never fired, which the create contract cannot tell you (045_webhooks).
A hook may name entity_types or event_type, never both, so read whichever is populated (050_webhook_subscriptions).
status is one of active, unstable, failed or disabled. Only disabled is set by a caller; the other three are the site's own assessment of the endpoint's health.