---
title: "Gets a webhook subscription by id."
method: GET
path: "/api/v1/orgs/{org}/webhooks/{id}"
tags: ["Webhooks"]
---

# Gets a webhook subscription by id.

`GET /api/v1/orgs/{org}/webhooks/{id}`

## Request

- Base URL: `https://api.featureflip.io`
- URL: `https://api.featureflip.io/api/v1/orgs/{org}/webhooks/{id}`
- Auth: API key in header `Authorization`

Requires Admin. Never returns secret values.

## Path parameters

- `org` string, required
- `id` string, required

## Headers

- `If-Match` string

## Response `200`

OK

- PublicWebhookSubscriptionResponse: A webhook subscription. Never carries secret material: signing secrets are listed by id and lifecycle only — the value itself is returned once, when it is created or rotated. `overPlanLimit` is true when the organization has more subscriptions than its plan allows, which happens after a downgrade. The oldest subscriptions up to the limit keep delivering. The rest receive nothing and cannot be re-enabled, tested or redelivered to until the plan is upgraded or older subscriptions are deleted.
  - `id` string, uuid, required
  - `name` string, nullable, required
  - `url` string, nullable, required
  - `provider` 'GenericHttp', nullable, required: Allowed values: GenericHttp.
  - `isEnabled` boolean, required
  - `eventTypes` string[], nullable, required
  - `projectIds` string[], nullable, required
  - `environmentIds` string[], nullable, required
  - `consecutiveFailureCount` integer, required
  - `autoDisabledAt` string, date-time, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `secrets` PublicWebhookSecretResponse[], nullable, required
    - `id` string, uuid, required
    - `createdAt` string, date-time, required
    - `retiredAt` string, date-time, nullable
  - `overPlanLimit` boolean, required
  - `_actions` object: Capability hints: which operations the authenticated caller may perform on this resource, each with allowed + optional reason. Computed from the caller's role and the resource's state. Injected at runtime; safe to ignore. Present only on top-level resource responses — nested occurrences (e.g. a rule inside a targeting-config response) do not carry it.

## Other responses

- `401`: Authentication is required, or the supplied API token is invalid or expired.
- `403`: Forbidden
- `404`: Not Found
- `412`: The resource's current ETag is not the If-Match one.
- `429`: Rate limit exceeded. Retry after the interval indicated by the Retry-After header.

---

[API](https://skmtc.dev/featureflip/apis/management-api.md) · [All operations](https://skmtc.dev/featureflip/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/featureflip/apis/management-api/revisions/8a77e8581a45?raw)