# Webhooks: subscribing to events

Source: https://help.ruuster.com/api/webhooks

> Subscribe a URL to lead events: who can subscribe, the subscription calls and the endpoint rules.

Webhooks send lead activity to a URL you host, typically within 15 minutes of the activity. They're
near-real-time, not instant. Every event is the same event the API returns from
`/leads/{leadId}/activity?events=1`, with the same `id`, so you can look an event up or rebuild what
you missed.

**Who can subscribe**
- Owner and admin keys only. Every subscription covers the whole brokerage.
- Up to 10 subscriptions per brokerage.
- Blocking a key pauses the subscriptions it created.

**Managing subscriptions.** These calls change only your subscription settings, never your Ruuster data.

| Call | What it does |
|---|---|
| [`GET /webhooks/events`](https://help.ruuster.com/api/webhooks-event-kinds) | The event catalog with a sample payload for each kind |
| [`GET /webhooks`](https://help.ruuster.com/api/webhooks-list) | Every subscription in your brokerage, with delivery health. Describes the subscription object |
| [`POST /webhooks`](https://help.ruuster.com/api/webhooks-create) | Create. Returns `201` and the signing `secret`, **once** |
| [`GET /webhooks/{webhookId}`](https://help.ruuster.com/api/webhooks-get) | One subscription |
| [`PATCH /webhooks/{webhookId}`](https://help.ruuster.com/api/webhooks-update) | Change `url`, `events`, `description`, or `status` (`active` \| `paused`) |
| [`DELETE /webhooks/{webhookId}`](https://help.ruuster.com/api/webhooks-delete) | Delete; pending deliveries are dropped |
| [`POST /webhooks/{webhookId}/test`](https://help.ruuster.com/api/webhooks-test) | Send a `webhook.test` now and return the result |
| [`POST /webhooks/{webhookId}/rotate-secret`](https://help.ruuster.com/api/webhooks-rotate-secret) | New secret; the old one keeps working for 24 hours |
| [`GET /webhooks/{webhookId}/deliveries`](https://help.ruuster.com/api/webhooks-deliveries) | Attempts from the last 30 days |
| [`POST /webhooks/{webhookId}/replay`](https://help.ruuster.com/api/webhooks-replay) | Re-send events from a window of up to 7 days, within the last 30 |

The secret is never returned again after creation or rotation. Subscriptions are `active`, `paused` (by you), `disabled` (after about 24 hours of failed deliveries) or `blocked` (by Ruuster).
**Endpoint rules.** HTTPS with a valid public certificate. URLs that point at private, loopback or
link-local addresses are refused when you save them and again before every delivery. No credentials in
the URL.