# Webhook access

You can create and manage webhooks by calling the APIs via direct access or via a third-party application per user authorization (via OAuth). Here's how webhook ownership, management, and deactivation differ based on the way the webhook was created.

A webhook created via direct API access has these characteristics:

* **Ownership:** The user who created it owns it.
* **Management:** Only the webhook owner can manage it.
* **Deactivation:** If the owner is deactivated, the webhook deactivates. **Note:** Revoking the token the owner used when creating the webhook doesn't affect the webhook status.


A webhook that is created by a third-party application has these characteristics:

* **Ownership:** The third-party app user who authorized the app to create the webhook owns the webhook.
* **Management:** The webhook owner or the authorized third-party app can manage the webhook.
* **Deactivation:** If the third-party app's permissions are revoked, the webhook permanently deactivates.


## Scope and events

A webhook monitors specified `events` in a specified `scope`.

### Scope

A [Webhook object's](/api/smartsheet/openapi/webhooks/webhook) `scope` attribute indicates the scope of the subscription. You specify the webhook scope when you create the webhook -- you cannot subsequently change the scope.

> **Note:** For a webhook with `scope` set to `sheet`, you can limit the webhook to specific columns by specifying their IDs in an array property called `subscope`. Plan-level webhooks (plan webhooks) do not support subscope.


### Events

A [Webhook object's](/api/smartsheet/openapi/webhooks/webhook) `events` attribute indicates the set of events that the webhook is subscribed to (that is, which events trigger a callback).

* Events are represented as a dot-separated string in the format "*object*.*event*", where an asterisk (*) can be used to represent "all objects" or "all events".
* Currently, `*.*` is the only supported value for the `events` attribute. This indicates a subscription to all objects in the scope, and all events for those objects.


> **Important:** Sheet webhooks are automatically disabled on sheets that exceed 20,000 rows, 400 columns, or 500,000 cells (whichever comes first). Stay within the specified limits to keep your sheet webhooks enabled.


> **Note:** When a row is deleted on a sheet, even if you are using a `subscope` to monitor columns only and the cell in that column for that row is empty, you will receive a "row.deleted" event.