---
title: "List Webhook Secrets"
method: GET
path: "/v1/webhooks/secrets"
tags: ["Webhook Subscriptions"]
---

# List Webhook Secrets

`GET /v1/webhooks/secrets`

This endpoint returns a set of webhook signing secrets used to validate the webhook.
Usually only one key will be returned in the response. After key rotation, this endpoint will return two keys:
the new key, and the key that will be revoked soon. There will also be two signatures in the 'Webhook-Signature' request header.
Your application should use all keys available to validate the webhook request. If validation passes for any
of the keys returned, the webhook payload is valid.

## Response `200`

Success

- WebhookSecret[]
  - `secret` string, required — The payload of the secret to be used for webhook validation.
  - `status` 'ACTIVE' | 'PENDING_REVOKE' | 'REVOKED', required — The status of this webhook secret.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal server error

---

[API](https://skmtc.net/brex-com/apis/webhooks-api.md) · [All operations](https://skmtc.net/brex-com/apis/webhooks-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/brex-com/webhooks-api/revisions/bc197ebb855c/schema)