X-Knock-Signature header, an HMAC-SHA256 of the raw request body. Call GET /v1/webhooks/{webhook_id}/secret to retrieve the full signing key needed to recompute and verify that signature.
Endpoint
Required Scope
Your API key must have thewebhooks:read scope (or the broader all:read scope) to call this endpoint.
Path Parameter
string
required
The unique identifier of the webhook subscription. You can find this value in the response from Create Webhook or List Webhooks.
Parameters
string
Act on a direct child tenant’s webhook subscription instead of your own (multi-tenant partners only). The
X-Knock-Tenant header takes precedence if both are supplied. See Reading a Child Tenant’s Data.string
Same as
product_slug above, as a header instead of a query param. Naming a slug that isn’t a direct child of your key returns 404, never 403.Example Request
Response
A successful request returns200 OK with a WebhookSecretResponse body.
string
The full hex-encoded signing key for this subscription. Use it to verify deliveries:
expected = HMAC-SHA256(signing_key, raw_request_body), then compare to the X-Knock-Signature header using a constant-time comparison.Unlike an API key, this value is never stored — it’s derived deterministically from the subscription ID on every request, so you can fetch it again at any time. There is no “shown only once” restriction, and requesting it repeatedly does not invalidate or rotate it.