diff --git a/cmd/server/main.go b/cmd/server/main.go
index 70b253d..d4aa111 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -205,10 +205,12 @@ func main() {
 				bot.NewCommandHandler(database.DB).RegisterCommandRoutes(r)
 			})
 
-			// Webhooks (protected: create/delete)
+			// Webhooks (protected: create/list/delete)
+			webhookHandler := webhook.NewHandler(database.DB, hub)
 			r.Route("/channels/{channelID}/webhooks", func(r chi.Router) {
-				webhook.NewHandler(database.DB, hub).RegisterRoutes(r)
+				webhookHandler.RegisterRoutes(r)
 			})
+			r.Delete("/webhooks/{webhookID}", webhookHandler.Delete)
 
 			// Invites (rate limited to prevent brute-force join)
 			r.Route("/invites", func(r chi.Router) {
diff --git a/internal/message/handlers.go b/internal/message/handlers.go
index 11b304f..70d5de9 100644
--- a/internal/message/handlers.go
+++ b/internal/message/handlers.go
@@ -30,8 +30,8 @@ func NewHandler(db *sql.DB, hub *gateway.Hub, pushHandler *push.Handler, logger
 }
 
 func (h *Handler) RegisterRoutes(r chi.Router) {
-	r.Get("/{channelID}/messages", h.List)
-	r.Post("/{channelID}/messages", h.Create)
+	r.Get("/", h.List)
+	r.Post("/", h.Create)
 	r.Patch("/{messageID}", h.Update)
 	r.Delete("/{messageID}", h.Delete)
 }
diff --git a/internal/webhook/handlers.go b/internal/webhook/handlers.go
index 3a14cce..fc643f6 100644
--- a/internal/webhook/handlers.go
+++ b/internal/webhook/handlers.go
@@ -29,9 +29,8 @@ func NewHandler(db *sql.DB, hub *gateway.Hub) *Handler {
 //	GET  /channels/{channelID}/webhooks  - list webhooks for channel
 //	DELETE /webhooks/{webhookID}          - delete webhook
 func (h *Handler) RegisterRoutes(r chi.Router) {
-	r.Post("/channels/{channelID}/webhooks", h.Create)
-	r.Get("/channels/{channelID}/webhooks", h.List)
-	r.Delete("/webhooks/{webhookID}", h.Delete)
+	r.Post("/", h.Create)
+	r.Get("/", h.List)
 }
 
 // RegisterPublicRoutes registers the public webhook execution route (no auth).