---
title: "Ingest Webhook Secret"
method: GET
path: "/v2/ingest/webhook-secret"
tags: ["v2", "v2-ingest"]
---

# Ingest Webhook Secret

`GET /v2/ingest/webhook-secret`

## Request

- Base URL: `https://api.enconvert.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.enconvert.com/v2/ingest/webhook-secret`
- Auth: none declared

Reveal the project's webhook signing secret, creating it on first call.

SENSITIVE: this is the only surface that exposes the secret, and only over
the authenticated dashboard channel, so a customer can configure HMAC
verification on their endpoint.

## Headers

- `X-API-Key` string, nullable
- `authorization` string, nullable

## Response `200`

Successful Response

- WebhookSecretResponse: A project's webhook signing secret plus the headers a consumer verifies. SENSITIVE: returned only over the authenticated dashboard channel so a customer can configure signature verification on their endpoint. ``rotated`` is True when this response just replaced the previous secret (signatures computed with the old secret stop verifying immediately).
  - `secret` string, required
  - `signature_header` string
  - `timestamp_header` string
  - `signature_scheme` string
  - `replay_tolerance_seconds` integer
  - `rotated` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/enconvert/apis/conversion-api.md) · [All operations](https://skmtc.dev/enconvert/apis/conversion-api/llms.txt) · [OpenAPI document](https://skmtc.dev/enconvert/apis/conversion-api/revisions/b8c820393569?raw)