---
title: "Webhook signing secret for a list"
method: GET
path: "/lists/{id}/webhook-secret"
tags: ["Lists"]
---

# Webhook signing secret for a list

`GET /lists/{id}/webhook-secret`

## Request

- Base URL: `https://api.companystack.co.uk`
- URL: `https://api.companystack.co.uk/lists/{id}/webhook-secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

The secret that signs this list's webhook deliveries with the `CompanyStack-Signature` header: the list owner's account secret, which also signs the watchlist's webhooks. Only the account owner can read it (it signs every webhook on the account), on a plan with webhooks: web-app Team, or any API key, the API Free plan included. Rotate it with POST /watchlist/webhook-secret/rotate (account owner).

## Path parameters

- `id` integer, required

## Response `200`

Secret, rotation details and the signature header format

## Other responses

- `401`: API key missing, malformed or revoked
- `403`: Plan limit or feature not included
- `404`: List not found (or private to the person who made it)
- `429`: Per-minute or per-day limit reached (`code: rate_limited`, `window: minute|day`). Wait `Retry-After` seconds; when both windows are full the day is reported. A refused request does not count against either limit. A bulk lookup (`POST /company/bulk`) counts each company number in it as one request, so one that is more than you have left is refused whole, and the body adds `requested` and `fits`.

---

[API](https://skmtc.dev/companystack/apis/companystack-api.md) · [All operations](https://skmtc.dev/companystack/apis/companystack-api/llms.txt) · [OpenAPI document](https://skmtc.dev/companystack/apis/companystack-api/revisions/8f3234237d2d?raw)