Skip to main content
GET
List webhook signing secrets
Returns metadata for the signing secrets on your account — never a secret value. The active secret signs every outbound callback. A secret shown as expiring was rotated out and keeps signing until expires_at, so deliveries stay verifiable while you deploy the new value. tolerance_seconds is the clock skew a Standard Webhooks verifier applies to webhook-timestamp by default. grace_hours is how long a rotated-out secret keeps signing. To read the active secret in full, use reveal. See verifying a webhook for the headers and a worked example.
These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Authorizations

Authorization
string
header
required

API key from the Omnifence dashboard

Response

200 - application/json

Default Response

secrets
object[]
required
tolerance_seconds
integer
required
grace_hours
integer
required