---
title: "Get a webhook"
method: GET
path: "/v1/webhooks/{id}"
tags: ["Webhooks"]
---

# Get a webhook

`GET /v1/webhooks/{id}`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/webhooks/{id}`
- Auth: HTTP bearer

Returns a single webhook owned by the calling tenant. The plaintext secret is never present on a read, only the prefix.

## Path parameters

- `id` string, required

## Response `200`

The webhook, if owned by the calling tenant. The signing secret is never returned on a read, only the prefix.

- object
  - `object` 'webhook': Response type discriminator.
  - `id` string: Webhook id (wh_-prefixed ULID).
  - `source` 'messaging' | 'user' | 'account_status' | 'post': The event source this webhook subscribes to (immutable).
  - `request_url` string: The URL that receives delivery POST requests.
  - `name` string, nullable: Human-readable label.
  - `account_ids` string[], nullable: Accounts targeted by this webhook (acc_ ids you own), or null when an account_status webhook covers every current and future account.
  - `enabled` boolean: A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped.
  - `headers` object[]: Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value.
    - `key` string: The header name, as configured.
    - `value_fingerprint` string, nullable: A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured.
  - `events` string[]: Canonical event names this webhook subscribes to.
  - `data` string[]: Field-remapping keys for the delivery payload (messaging and user sources only; post and account_status have none).
  - `secret_prefix` string: First 8 characters of the signing secret. The full secret is never returned on edit, it is preserved unchanged.
  - `created_at` string: ISO-8601 creation timestamp.
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `400`: Malformed or empty webhook id.
- `401`: Missing or invalid API key.
- `404`: Webhook not found or not owned by this tenant.
- `429`: Rate limited, slow down and retry after the hinted delay.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)