List webhook signing secrets

Metadata for the signing secrets on your account. The active secret signs every outbound callback; a secret shown as expiring was rotated out and keeps signing until expires_at, so a receiver has time to redeploy. Secret values are never included here — read one with POST /me/webhook-secrets/reveal.

GEThttps://api.omnifence.ai/api/v1/me/webhook-secrets

Returns metadata for the signing secrets on your account — never a secret value. The active secret signs every outbound callback. A secret shown as expiring was rotated out and keeps signing until expires_at, so deliveries stay verifiable while you deploy the new value.

tolerance_seconds is the clock skew a Standard Webhooks verifier applies to webhook-timestamp by default. grace_hours is how long a rotated-out secret keeps signing.

To read the active secret in full, use reveal. See verifying a webhook for the headers and a worked example.

These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Request#

Headers#

Name	Type	Required	Description
`Authorization`	string	Yes	Your API key as a Bearer token: `Bearer YOUR_API_KEY`.

Responses#

200 OK#

Field	Type	Always present	Description
`secrets`	array of object	Yes
`secrets[].id`	string	Yes
`secrets[].created_at`	string (date-time)	Yes
`secrets[].expires_at`	null or string (date-time)	Yes
`secrets[].status`	string	Yes	One of `active`, `expiring`.
`tolerance_seconds`	integer	Yes
`grace_hours`	integer	Yes

Example responseJSON

{
  "secrets": [
    {
      "id": "string",
      "created_at": "2026-05-19T12:00:00.000Z",
      "expires_at": "2026-05-19T12:00:00.000Z",
      "status": "active"
    }
  ],
  "tolerance_seconds": 0,
  "grace_hours": 0
}