2026-07-02

DELETE /v3/webhooks/{id}

• Changed: Now returns a 404 when deleting a webhook owned by a different client application of the same partner, instead of allowing any of the partner's client applications to delete it.

GET /v3/* (all list endpoints)

• Fixed: List (index) endpoints now return an empty array instead of live data for requests authenticated through an organization-level OAuth client application whose underlying user is not an admin or a service account.

GET /v3/webhooks

• Added: client_id to the response, exposing the client_id of the partner client application that owns the webhook (null when the webhook is unattributed).
• Changed: Now returns only webhooks owned by the requesting client application, plus unattributed webhooks, instead of every webhook belonging to the partner regardless of which client application created it.

PATCH /v3/webhooks/{id}

• Added: client_id to the response, exposing the client_id of the owning client application (null when the webhook is unattributed).
• Changed: Now returns a 404 when updating a webhook owned by a different client application of the same partner, instead of allowing any of the partner's client applications to update it.

POST /v3/webhooks

• Added: client_id to the response, exposing the client_id of the owning client application (null when the webhook is unattributed).