Get a webhook (includes the signing secret for webhook:manage tokens)
The signing secret is the ability to forge signed deliveries, so it rides only on tokens holding webhook:manage — a read-only token gets every other field.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Response
Webhook found
webhook Consecutive failed delivery attempts (circuit-breaker streak; any success resets).
-9007199254740991 <= x <= 9007199254740991While in the future, deliveries to this endpoint are held and sent after the window (cooldown).
Set when the system disabled the endpoint after sustained delivery failure.
HMAC signing secret (whsec_...). Present only for tokens holding webhook:manage, and only on single-object reads, create, and rotate. An EMPTY string means the stored secret can no longer be decrypted (e.g. the encryption key changed) — call rotate-secret to mint a fresh one.