List the restaurant's webhooks
Partner key + restaurant key. Never includes the signing secret. A restaurant has at most 10 webhooks, so nextCursor is always null.
Authentication
The partner key, sent as Authorization: Bearer lbp_test_…. Created in the partner portal under Partner key. It belongs to the partner, not to a restaurant, and only works against /api/v1/partner. Server to server only: a request with an Origin header is rejected with 403 FORBIDDEN. A test key sees and creates only sandboxes; live partner keys are not available yet. A revoked key, a restaurant key (lbs_…) here, or a suspended or archived partner returns 401 UNAUTHORIZED; an expired key returns 401 KEY_EXPIRED.
The restaurant’s own key (lbs_test_… or lbs_live_…), sent in X-LettBestilt-Restaurant-Key together with the partner key for calls about one restaurant. The key must have full access (scope *, otherwise 403 INSUFFICIENT_SCOPE), belong to a restaurant the partner owns, and be in the same environment as the partner key (otherwise 401 UNAUTHORIZED). A slug that does not exist, belongs to another partner or does not match the key always gives the same 404 RESTAURANT_NOT_FOUND. Older keys without an environment in the prefix (lbs_<random>) are not accepted here; rotate them in the partner portal.