---
title: "Get a webhook signing secret"
method: GET
path: "/v2/webhook_endpoints/{id}/secret"
tags: ["Webhook endpoints"]
---

# Get a webhook signing secret

`GET /v2/webhook_endpoints/{id}/secret`

## Request

- Base URL: `https://api.logo.dev`
- URL: `https://api.logo.dev/v2/webhook_endpoints/{id}/secret`
- Auth: HTTP bearer

Returns the endpoint's signing secret, used to verify deliveries. Any team member can read it. Needs a paid plan. See [Who can use webhooks](/webhooks#who-can-use-webhooks).

## Path parameters

- `id` string, required

## Response `200`

The current secret.

- object
  - `data` V2WebhookEndpointSecret, required
    - `object` 'webhook_endpoint_secret', required
    - `key` string, required: The endpoint's signing secret. Use it to verify that deliveries come from Logo.dev.
  - `metadata` V2Metadata, required
    - `request_id` string, required: Unique id for this request. Also sent as the `Request-Id` header.
    - `resolution` V2Resolution: How the request identified the brand.
      - `type` 'domain' | 'ticker' | 'isin' | 'crypto' | 'name' | 'brand_id', required: Which identifier the request used.
      - `value` string, required: The identifier after normalization: the registrable domain, an upper-cased ticker, and so on.
      - `method` 'direct' | 'domain' | 'security' | 'crypto' | 'search' | '', required: How the identifier reached the brand. `direct` is a brand id or a domain that is its own brand; `domain` went through an alias or redirect; `security` is a ticker or ISIN; `crypto` is a crypto token symbol; `search` is a name lookup. Empty on a cached miss.
      - `context` object, required: Reserved for brands involved in a merchant lookup. Always `{}` today.
    - `pending` V2Pending: Present only on a `202`. Tells you when to retry.
      - `reason` 'indexing' | 'resolving', required: `indexing` is a brand's first crawl; `resolving` means the identifier is still being matched to a brand.
      - `message` string, required
      - `retry_after_seconds` integer, required: Wait this long before retrying. Matches the `Retry-After` header.
      - `expires_in_seconds` integer, required: Stop polling after this long.
      - `webhook` boolean, required: Whether a `brand.indexed` webhook event carrying this request's `request_id` will be sent when the lookup settles.
      - `doc_url` string, uri, required
    - `subscription` object: Present when a brand lookup (`GET /v2/brands` or `GET /v2/brands/{id}`) ran the automatic subscribe: webhooks are on for the account, and `nosubscribe` is not `true`. See [automatic subscriptions](/brand/introduction#automatic-subscriptions).
      - `status` 'subscribed' | 'quota_exceeded', required: `subscribed`: the account is subscribed to the brand. `quota_exceeded`: the account is at its plan's subscription limit, so the brand was not subscribed. The lookup is answered and billed either way.
      - `message` string: Why the subscribe was refused. Only with `quota_exceeded`.

## Other responses

- `401`: The secret key is missing, malformed, unknown, or disabled. A publishable key (`pk_`) is refused.
- `403`: Your plan does not include webhooks, or your role cannot change them. See [Who can use webhooks](/webhooks#who-can-use-webhooks).
- `404`: No webhook endpoint has this id.
- `500`: Managing the endpoint failed.

---

[API](https://skmtc.dev/logo/apis/logo-dev-api.md) · [All operations](https://skmtc.dev/logo/apis/logo-dev-api/llms.txt) · [OpenAPI document](https://skmtc.dev/logo/apis/logo-dev-api/revisions/6251e2aca8fb?raw)