Read the signing secret
Requires webhooks:manage. Re-showable on purpose. An API key is only ever compared, so storing its hash is enough; this secret has to sign every delivery, so the row holds it either way — and once that is true, showing it once would only stop you from reading what the database plainly contains, while costing you the one recovery that is not “rotate and break every deployed verifier at once”.
Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.
Path Parameters
The webhook endpoint's id.
Response
The secret.