Retrieve a webhook

Fetch one webhook by its id — including its signing secret.

GET /v1/webhooks/{id}

Requires a Full access API key.

Path parameters

Parameter	Type	Required	Description
id	string	Yes	The webhook id.

Example

curl

curl "https://api.sendgrail.com/v1/webhooks/$WEBHOOK_ID" \
  -H "Authorization: Bearer $SENDGRAIL_API_KEY"

Node.js

const res = await fetch(`https://api.sendgrail.com/v1/webhooks/${id}`, {
  headers: { Authorization: `Bearer ${process.env.SENDGRAIL_API_KEY}` },
});

const webhook = await res.json();

Response

{
  "object": "webhook",
  "id": "5f1c3a9e-0d42-4b7c-9a63-2e8b41d7c015",
  "name": "Production events",
  "endpoint": "https://hooks.example.com/sendgrail",
  "events": ["email.delivered", "email.bounced", "email.complained"],
  "status": "enabled",
  "created_at": "2026-07-14T19:44:32+00:00",
  "signing_secret": "whsec_3kQpV8ZrN2xLbT7yaJ6uWfE1sHdC4gMoR9vKtXqBnZyPmA0j"
}

Field	Description
object	Always webhook.
id	The webhook id.
name	Your label, or null.
endpoint	The HTTPS URL we POST events to.
events	The event types this webhook receives. See the event catalog.
status	enabled or disabled. A disabled webhook receives nothing.
created_at	ISO 8601 time the webhook was registered.
signing_secret	The HMAC key for verifying deliveries.

This is where you get the secret back

signing_secret is returned here, on create and on rotate — but never in a list. A retrieve names one webhook deliberately; a list is the call you make casually, and there is no reason for it to hand back every secret you own.

So if you lost the secret from the create response, this is the call that gives it back. The request log will not: signing_secret is stored there as [redacted], precisely so that a Full-access key cannot read your webhook secrets out of your own log history.

The secret is generated by us and cannot be supplied by you. To replace it, see Rotate a webhook's signing secret.

A webhook that isn't yours answers 404

A webhook belonging to another team answers 404, not 403 — an id that isn't yours is an id that doesn't exist, as far as your key is concerned. 403 would confirm the webhook exists.

{
  "message": "No webhook with the id 5f1c3a9e-0d42-4b7c-9a63-2e8b41d7c015.",
  "code": "not_found",
  "request_id": "8f2c1e64-1b17-4f8c-9f0e-3b6c1e0f5c31"
}

A Sending-access key is a different failure: it is a real key, it just isn't allowed here, so it answers 403. See Errors.