Reveal webhook signing secret | Omnifence API docs

Returns the active signing secret in full, ready to paste into a Standard Webhooks library.

This is a POST rather than a GET so the value never lands in a URL, a proxy access log, or a browser history entry. You can reveal the secret whenever you need it — rotation is for a secret that has leaked, not for one you have mislaid.

See verifying a webhook.

These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Request#

Headers#

Name	Type	Required	Description
`Authorization`	string	Yes	Your API key as a Bearer token: `Bearer YOUR_API_KEY`.

Responses#

200 OK#

Field	Type	Always present	Description
`secret`	string	Yes
`secrets`	array of object	Yes
`secrets[].id`	string	Yes
`secrets[].created_at`	string (date-time)	Yes
`secrets[].expires_at`	null or string (date-time)	Yes
`secrets[].status`	string	Yes	One of `active`, `expiring`.

Example responseJSON

{
  "secret": "string",
  "secrets": [
    {
      "id": "string",
      "created_at": "2026-05-19T12:00:00.000Z",
      "expires_at": "2026-05-19T12:00:00.000Z",
      "status": "active"
    }
  ]
}