---
title: "Read the per-tenant assertion signing secret (minted on first read)"
method: GET
path: "/api/outcome/secret"
tags: ["Outcome"]
---

# Read the per-tenant assertion signing secret (minted on first read)

`GET /api/outcome/secret`

## Request

- Base URL: `https://api.wordis-bond.com`
- URL: `https://api.wordis-bond.com/api/outcome/secret`
- Auth: HTTP bearer

Word Is Bond signs every outbound assertion request with this secret. Verify it on your endpoint: recompute hex(HMAC-SHA256(secret, `${wb-timestamp}.${rawBody}`)), compare in constant time, and reject a timestamp more than 5 minutes old. Rotate with POST /api/outcome/secret/rotate.

## Response `200`

The signing secret + verification recipe

- object
  - `data` object, required
    - `secret` string, required
    - `signatureHeader` 'wb-signature'
    - `timestampHeader` 'wb-timestamp'
    - `verify` string
  - `error` union, required
    - object
    - string

## Other responses

- `401`: Missing, invalid, or revoked credentials.

---

[API](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api.md) · [All operations](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api/revisions/66c2d5480d84?raw)