List subscriptions
Lists the authenticated tenant’s live subscriptions, newest-first, keyset-paginated. No read projection ever carries the signing secret.
Authorizations
A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.
Query Parameters
Optional filter restricting results to one sink kind.
The delivery destination kind. webhook posts signed HTTPS requests; pull exposes an inbox read over GET /v1/events; sqs, rabbitmq, and eventbridge fan out to the named queue or bus.
webhook, pull, sqs, rabbitmq, eventbridge Page size, clamped to a server maximum. A non-positive value uses the server default.
Keyset cursor — the id of the last row from the previous page (subscriptions are ordered DESC by id).

