Read the scan webhook

Returns the endpoint, its signing secret in full, and the last twenty delivery attempts.

The secret is returned on every read, unlike an API key. That is not an oversight: we are the sender, computing the HMAC requires the secret itself, so there is nothing to hash it into and no honest way to claim we cannot read it. Available on every plan, so a customer whose plan lapsed can still see and remove an endpoint that is receiving their data.