---
title: "Read Subscription Secret"
method: GET
path: "/api/v1/webhook-subscriptions/{subscription_id}/secret"
tags: ["webhook-subscriptions"]
---

# Read Subscription Secret

`GET /api/v1/webhook-subscriptions/{subscription_id}/secret`

## Request

- Base URL: `https://api.gnosari.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gnosari.com/api/v1/webhook-subscriptions/{subscription_id}/secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-AUTH-TOKEN`

Read the plaintext ``whsec_`` signing secret (FR-3.2).

The ONLY endpoint that returns the secret, and the single sanctioned
``get_secret_value()`` unwrap in the codebase -- default ``SecretStr``
serialization would mask it as ``**********``.

## Path parameters

- `subscription_id` integer, required

## Response `200`

Successful Response

- WebhookSubscriptionSecretResponse: The plaintext signing secret -- returned ONLY by ``GET /{id}/secret``. The field is a plain ``str`` on purpose: the endpoint populates it via an explicit ``SecretStr(...).get_secret_value()`` at the response boundary (the one sanctioned unwrap in the codebase). A ``SecretStr`` field here would serialize as ``**********`` and FR-3.2 would be dead.
  - `secret` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/gnosari/apis/gnosari-api.md) · [All operations](https://skmtc.dev/gnosari/apis/gnosari-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gnosari/apis/gnosari-api/revisions/f299cf53ae5f?raw)