---
title: "Read the scan webhook"
method: GET
path: "/api/webhook"
tags: ["Webhooks"]
---

# Read the scan webhook

`GET /api/webhook`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/webhook`
- Auth: HTTP bearer

Returns the endpoint, its signing secret in full, and the last twenty delivery attempts.

The secret is returned on every read, unlike an API key. That is not an oversight: we are the
sender, computing the HMAC requires the secret itself, so there is nothing to hash it into and
no honest way to claim we cannot read it. Available on every plan, so a customer whose plan
lapsed can still see and remove an endpoint that is receiving their data.

## Response `200`

The endpoint, entitlement and recent deliveries.

- object
  - `entitled` boolean, required: Pro and above.
  - `planId` string, required
  - `endpoint` object, nullable, required
    - `url` string, uri
    - `secret` string
    - `enabled` boolean
    - `createdAt` string, date-time
    - `lastSuccessAt` string, date-time, nullable
    - `lastFailureAt` string, date-time, nullable
    - `lastError` string, nullable
    - `disabledAt` string, date-time, nullable
    - `disabledReason` string, nullable
  - `deliveries` WebhookDelivery[], required
    - `id` integer
    - `event` 'scan.recorded'
    - `status` 'pending' | 'delivered' | 'failed'
    - `attempts` integer
    - `responseStatus` integer, nullable
    - `lastError` string, nullable
    - `createdAt` string, date-time
    - `deliveredAt` string, date-time, nullable

## Other responses

- `401`: No valid session

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)