---
title: "Get a deployment's Outlook subscription client state (secret)"
method: GET
path: "/api/v1/apps/{appId}/email-subscriptions/{subscriptionId}/client-state"
tags: ["Apps"]
---

# Get a deployment's Outlook subscription client state (secret)

`GET /api/v1/apps/{appId}/email-subscriptions/{subscriptionId}/client-state`

## Request

- Base URL: `https://app.khotan.com`
- URL: `https://app.khotan.com/api/v1/apps/{appId}/email-subscriptions/{subscriptionId}/client-state`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-api-key`

Returns the Outlook subscription's clientState — the secret Microsoft Graph sends with every notification to the delivery URL. Compare it in constant time and reject notifications that don't match. Treat it as a secret. Returns 400 client_state_unsupported for Gmail subscriptions, which are verified by Pub/Sub OIDC instead.

## Path parameters

- `appId` string, required
- `subscriptionId` string, required

## Response `200`

The subscription's client state. Secret-bearing.

- object
  - `subscriptionId` string, required
  - `clientState` string, required

## Other responses

- `400`: The request was malformed or failed validation.
- `401`: Authentication is missing or invalid.
- `404`: The resource was not found.
- `429`: Too many requests; retry after the indicated delay.

---

[API](https://skmtc.dev/khotan/apis/khotan-api.md) - [All operations](https://skmtc.dev/khotan/apis/khotan-api/llms.txt) - [OpenAPI document](https://skmtc.dev/khotan/apis/khotan-api/revisions/90b512a53e42?raw)