# Webhook access

You can create and manage webhooks by calling the APIs via direct access or via a third-party application per user authorization (via OAuth). Here's how webhook ownership, management, and deactivation differ based on the way the webhook was created.

A webhook created via direct API access has these characteristics:

* **Ownership:** The user who created it owns it.
* **Management:** Only the webhook owner can manage it.
* **Deactivation:** If the owner is deactivated, the webhook deactivates. **Note:** Revoking the token the owner used when creating the webhook doesn't affect the webhook status.


A webhook that is created by a third-party application has these characteristics:

* **Ownership:** The third-party app user who authorized the app to create the webhook owns the webhook.
* **Management:** The webhook owner or the authorized third-party app can manage the webhook.
* **Deactivation:** If the third-party app's permissions are revoked, the webhook permanently deactivates.


## Scope and events

A webhook monitors specified `events` in a specified `scope`.

### Scope

A [Webhook object's](/api/smartsheet/openapi/webhooks/webhook) `scope` attribute indicates the scope of the subscription. You specify the webhook scope when you create the webhook -- you cannot subsequently change the scope.

> **Note:** For a webhook with `scope` set to `sheet`, you can limit the webhook to specific columns by specifying their IDs in an array property called `subscope`. Plan-level webhooks (plan webhooks) do not support subscope.


### Events

A [Webhook object's](/api/smartsheet/openapi/webhooks/webhook) `events` attribute indicates the set of events that the webhook is subscribed to (that is, which events trigger a callback).

* Events are represented as a dot-separated string in the format "*object*.*event*", where an asterisk (*) can be used to represent "all objects" or "all events".
* For **sheet webhooks**, you can use `"*.*"` to subscribe to all events, or specify one or more event patterns to receive only matching events (for example, `["row.created", "cell.updated"]`). See the [Sheet webhook](/api/smartsheet/openapi/schemas/sheetwebhook) schema's `events` property for the full list of supported patterns.
* For **plan webhooks**, you can filter on hierarchical event patterns such as `"user.seatType.updated"`. See [Webhook event types](/api/smartsheet/webhook-event-types#plan-webhook-event-filtering) for details.


> **Note:** When a row is deleted on a sheet, even if you are using a `subscope` to monitor columns only and the cell in that column for that row is empty, you will receive a "row.deleted" event.