List subscriptions
Lists the authenticated tenant’s live subscriptions, newest-first, keyset-paginated. No read projection ever carries the signing secret. Each row carries endpoint_display, a short rendering of the destination; read the full destination with GET /v1/subscriptions/{id}/endpoint.
Authorizations
A bearer JWT issued by Access Manager. The /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token with the Access Manager client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.
Query Parameters
Optional filter restricting results to one sink kind. Any other value returns 422 validation_error.
The delivery destination kind. webhook posts signed HTTPS requests; pull exposes an inbox read over GET /v1/events; sqs, rabbitmq, and eventbridge fan out to the named queue or bus.
webhook, pull, sqs, rabbitmq, eventbridge Page size, clamped to a server maximum. A non-positive value uses the server default.
Keyset cursor — the id of the last row from the previous page (subscriptions are ordered DESC by id). A value that is not a UUID returns 422 validation_error.
Optional exact-name filter, trimmed before matching. It matches in your scope, the same scope the create checks for a name conflict, so a hit is a page of one. A value that is only whitespace returns 422 validation_error.
Optional filter on the enabled flag, true or false. Any other value returns 422 validation_error.
Optional filter on the verification state.
The subscription's position in the destination verification state machine. Only an active subscription is deliverable. A pull subscription is born active — it has no destination to probe. Every other kind is born pending_verification and reaches active on a successful probe: POST /v1/subscriptions/{id}/ping for a webhook, and PUT /v1/subscriptions/{id}/credential for any queue sink (sqs, rabbitmq, eventbridge). An sqs or eventbridge sink has a second path: register a delegated grant — which persists the coordinates and leaves this field unchanged — then call POST /v1/subscriptions/{id}/verify. An active subscription whose probe later fails becomes degraded. The same successful probe returns this field to active. This field is one half of deliverability: enabled is the other half, and both must hold. No probe changes enabled except POST /v1/subscriptions/{id}/verify, which on a probe success clears an auto-disable in the same transaction as the state move.
pending_verification, active, degraded 
