List every active (non-soft-deleted) webhook subscription owned by the caller's partner company, newest first. Raw HMAC secret material is never returned — only the fingerprint.

Auth: Partner — authentication. The controller calls requirePartnerCompanyId, which 401s if unauthenticated and 403s unless request.user.person.company.bundle_id === 1 (partner-admin). The endpoint scopes rows to that resolved partner_company_id.

Rate limit: No rate limit.

Request

• No path/query/body params.

Response — { data: { data: [.] } } envelope; data.data is the array of subscriptions.

• id (int)
• partner_company_id (int)
• label (string)
• webhook_url (string)
• events (array|null) — null = wildcard (all events)
• payload_mode (string) — full | minimal; defaults to full
• delivery_kind (string) — immediate | batch
• batch_interval_hours (int|null) — null on immediate subs
• delivery_label (string) — human label, e.g. immediate or every 4 hours
• last_batch_dispatched_at (string ISO-8601|null)
• is_active (bool)
• hmac_secret_fingerprint (string)
• last_succeeded_at (string ISO-8601|null)
• last_failed_at (string ISO-8601|null)
• last_failure_reason (string|null)
• consecutive_failure_count (int)
• created_at / updated_at (string ISO-8601)