> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omnifence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Reveal webhook signing secret

> Return the active signing secret in full, ready to paste into a Standard Webhooks library. A POST rather than a GET so the value never lands in a URL, a proxy access log or a browser history entry.

Returns the active signing secret in full, ready to paste into a Standard Webhooks library.

This is a `POST` rather than a `GET` so the value never lands in a URL, a proxy access log, or a
browser history entry. You can reveal the secret whenever you need it — rotation is for a secret that
has leaked, not for one you have mislaid.

See [verifying a webhook](/platform/webhooks#verifying-a-webhook).

<Note>
  These endpoints need the `webhook:manage` scope. Your dashboard session carries it, so **Account →
  Webhooks** always works. An API key does not carry it by default — a key that only moderates
  content must not be able to read the credential that proves a callback came from us. [Contact
  support](mailto:support@omnifence.ai) if you need it on a key.
</Note>


## OpenAPI

````yaml api-reference/openapi.json POST /api/v1/me/webhook-secrets/reveal
openapi: 3.1.0
info:
  title: Omnifence API
  description: >-
    Content moderation API. Clients submit images or videos which pass through a
    classification pipeline and receive a pass/reject decision.
  version: 1.0.0
  contact:
    email: support@omnifence.ai
servers:
  - url: http://localhost:3051
    description: Local development
security:
  - bearerAuth: []
tags:
  - name: Moderation
    description: Submit moderation jobs
  - name: Jobs
    description: Query job status and progress
  - name: Webhooks
    description: Webhook registration
  - name: Account
    description: Authenticated client account settings
paths:
  /api/v1/me/webhook-secrets/reveal:
    post:
      tags:
        - Webhooks
      summary: Reveal the active webhook signing secret
      description: >-
        Return the active signing secret in full, ready to paste into a Standard
        Webhooks library. A POST rather than a GET so the value never lands in a
        URL, a proxy access log or a browser history entry.
      operationId: revealMyWebhookSecret
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                properties:
                  secret:
                    type: string
                  secrets:
                    type: array
                    items:
                      type: object
                      additionalProperties: false
                      properties:
                        id:
                          type: string
                        created_at:
                          type: string
                          format: date-time
                        expires_at:
                          type:
                            - 'null'
                            - string
                          format: date-time
                        status:
                          type: string
                          enum:
                            - active
                            - expiring
                      required:
                        - id
                        - created_at
                        - expires_at
                        - status
                required:
                  - secret
                  - secrets
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API key from the Omnifence dashboard

````