---
title: "Webhook signing secret"
method: GET
path: "/watchlist/webhook-secret"
tags: ["Watchlist"]
---

# Webhook signing secret

`GET /watchlist/webhook-secret`

## Request

- Base URL: `https://api.companystack.co.uk`
- URL: `https://api.companystack.co.uk/watchlist/webhook-secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Api-Key`

Watchlist alerts are POSTed to each entry's webhook_url as JSON events (`type: company.alert`). Verify the `CompanyStack-Signature` header: `t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>`, compare in constant time, reject timestamps older than 5 minutes, and de-duplicate on `CompanyStack-Event-Id`. Failed deliveries are retried after 1m, 5m, 30m, 2h, 6h, 12h and 24h.

## Response `200`

Secret

## Other responses

- `401`: API key missing, malformed or revoked
- `403`: The key's plan does not include this endpoint (`code: plan_upgrade_required`, with `upgrade_url`), the key may not call it, or the key is beyond the plan's key limit after a downgrade (`code: key_limit_exceeded`: the newest keys are paused until keys are deleted or the plan upgraded)
- `429`: Per-minute or per-day limit reached (`code: rate_limited`, `window: minute|day`). Wait `Retry-After` seconds; when both windows are full the day is reported. A refused request does not count against either limit. A bulk lookup (`POST /company/bulk`) counts each company number in it as one request, so one that is more than you have left is refused whole, and the body adds `requested` and `fits`.

---

[API](https://skmtc.dev/companystack/apis/companystack-api.md) · [All operations](https://skmtc.dev/companystack/apis/companystack-api/llms.txt) · [OpenAPI document](https://skmtc.dev/companystack/apis/companystack-api/revisions/8f3234237d2d?raw)