> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autosend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Reveal Webhook Secret

> Returns the raw signing secret for a webhook so you can verify payload signatures. The webhook must belong to the authenticated organization.

<Note>
  This endpoint accepts a **project API key** (`AS_` prefix). It returns the raw HMAC signing secret used to verify payload signatures. The webhook must belong to the authenticated organization.
</Note>

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET \
    --url https://api.autosend.com/v1/webhooks/60d5ec49f1b2c72d9c8b1234/reveal \
    --header 'Authorization: Bearer AS_your-api-key'
  ```

  ```python Python theme={null}
  import requests

  webhook_id = "60d5ec49f1b2c72d9c8b1234"
  url = f"https://api.autosend.com/v1/webhooks/{webhook_id}/reveal"

  headers = {
      "Authorization": "Bearer AS_your-api-key"
  }

  response = requests.get(url, headers=headers)
  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const webhookId = '60d5ec49f1b2c72d9c8b1234';

  fetch(`https://api.autosend.com/v1/webhooks/${webhookId}/reveal`, {
    method: 'GET',
    headers: {
      'Authorization': 'Bearer AS_your-api-key'
    }
  })
    .then(response => response.json())
    .then(data => console.log(data))
    .catch(error => console.error('Error:', error));
  ```

  ```php PHP theme={null}
  <?php

  $webhookId = '60d5ec49f1b2c72d9c8b1234';
  $url = "https://api.autosend.com/v1/webhooks/{$webhookId}/reveal";

  $ch = curl_init($url);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'Authorization: Bearer AS_your-api-key'
  ]);

  $response = curl_exec($ch);
  curl_close($ch);

  echo $response;
  ?>
  ```

  ```go Go theme={null}
  package main

  import (
      "fmt"
      "io"
      "net/http"
  )

  func main() {
      webhookID := "60d5ec49f1b2c72d9c8b1234"
      url := "https://api.autosend.com/v1/webhooks/" + webhookID + "/reveal"

      req, _ := http.NewRequest("GET", url, nil)
      req.Header.Set("Authorization", "Bearer AS_your-api-key")

      client := &http.Client{}
      resp, err := client.Do(req)
      if err != nil {
          fmt.Println("Error:", err)
          return
      }
      defer resp.Body.Close()

      body, _ := io.ReadAll(resp.Body)
      fmt.Println(string(body))
  }
  ```

  ```java Java theme={null}
  import java.io.BufferedReader;
  import java.io.InputStreamReader;
  import java.net.HttpURLConnection;
  import java.net.URL;

  public class RevealWebhookSecret {
      public static void main(String[] args) {
          try {
              String webhookId = "60d5ec49f1b2c72d9c8b1234";
              URL url = new URL("https://api.autosend.com/v1/webhooks/" + webhookId + "/reveal");
              HttpURLConnection con = (HttpURLConnection) url.openConnection();

              con.setRequestMethod("GET");
              con.setRequestProperty("Authorization", "Bearer AS_your-api-key");

              BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
              String inputLine;
              StringBuilder content = new StringBuilder();
              while ((inputLine = in.readLine()) != null) {
                  content.append(inputLine);
              }
              in.close();
              System.out.println(content.toString());

          } catch (Exception e) {
              e.printStackTrace();
          }
      }
  }
  ```

  ```ruby Ruby theme={null}
  require 'net/http'
  require 'uri'

  webhook_id = '60d5ec49f1b2c72d9c8b1234'
  uri = URI("https://api.autosend.com/v1/webhooks/#{webhook_id}/reveal")

  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = true

  request = Net::HTTP::Get.new(uri.request_uri)
  request['Authorization'] = 'Bearer AS_your-api-key'

  response = http.request(request)
  puts response.body
  ```
</RequestExample>

<ResponseExample>
  ```json 200 Response theme={null}
  {
    "success": true,
    "data": {
      "secret": "whsec_8f3a1c2d4e5b6a7c8d9e0f1a2b3c4d5e"
    }
  }
  ```
</ResponseExample>

***

#### Authorizations

<ParamField path="Authorizations" type="string | header" required>
  Project API key header of the form Bearer `AS_<key>`.
</ParamField>

### Path Parameters

<ParamField path="id" type="string" required>
  The unique identifier of the webhook.

  Example: `"60d5ec49f1b2c72d9c8b1234"`
</ParamField>

#### Response

<span className="text-sm">Secret revealed successfully (200)</span>

<ResponseField name="success" type="boolean">
  Indicates if the request was successful
</ResponseField>

<ResponseField name="data" type="object">
  Wrapper containing the secret

  <Expandable title="child attributes">
    <ResponseField name="data.secret" type="string">
      The raw HMAC signing secret. Use it to verify the `X-Webhook-Signature` header on incoming deliveries.
    </ResponseField>
  </Expandable>
</ResponseField>

#### Error Responses

<ResponseField name="403 - Unauthorized webhook access" type="object">
  Returned when the webhook does not belong to the authenticated organization.

  ```json theme={null}
  {
    "success": false,
    "error": {
      "message": "Unauthorized access to webhook",
      "code": "UNAUTHORIZED_WEBHOOK_ACCESS",
      "status": 403
    }
  }
  ```
</ResponseField>

<ResponseField name="404 - Webhook not found" type="object">
  Returned when no webhook with the given ID exists in the project.

  ```json theme={null}
  {
    "success": false,
    "error": {
      "message": "Webhook not found",
      "code": "WEBHOOK_NOT_FOUND",
    }
  }
  ```
</ResponseField>


## OpenAPI

````yaml GET /webhooks/{id}/reveal
openapi: 3.1.0
info:
  title: AutoSend API
  description: >-
    AutoSend REST API for managing project webhooks. These endpoints accept a
    project API key (AS_ prefix) and let you subscribe to email and contact
    events, inspect delivery logs, and test deliveries.
  version: 1.0.0
servers:
  - url: https://api.autosend.com/v1
security:
  - bearerAuth: []
paths:
  /webhooks/{id}/reveal:
    get:
      summary: Reveal Webhook Secret
      description: >-
        Returns the raw signing secret for a webhook so you can verify payload
        signatures. The webhook must belong to the authenticated organization.
components: {}

````