# Get a webhook endpoint

`GET /v1/webhook-endpoints/{endpoint_id}` · permission `webhook-endpoints:read` · all plans

Returns one webhook endpoint. The `ETag` header is the endpoint's version and the `If-Match` value for [update](update.md) and [delete](delete.md). The signing secret is never returned here.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `endpoint_id` | path | yes | Webhook endpoint ID (`whe_…`). |

## Response

`200 OK` with the endpoint.

| Field | Description |
|---|---|
| `id` | Endpoint ID (`whe_…`). |
| `key` | Stable key, unique in the environment. |
| `url` | Receiver URL. |
| `description` | Free text; empty string if none. |
| `event_types` | Selected catalog event types; empty means every type except the high-volume ones. |
| `event_schema_versions` | Event type → schema version overrides. |
| `payload_mode` | `thin` or `full`. |
| `status` | `enabled`, `disabled_by_user`, `disabled_by_failure` (no successful delivery for 5 days and at least 10 abandoned deliveries) or `disabled_by_receiver` (the receiver answered `410 Gone`). Re-enable with [update](update.md) and `"status": "enabled"`; use replay for the events of the disabled period. |
| `rate_limit_per_second` | Delivery rate cap for this endpoint. |
| `previous_secret_expires_at` | After a rotation, the end of the period in which the old secret still signs deliveries; otherwise `null`. |
| `last_success_at` | Last successful delivery, or `null`. |
| `failing_since` | Start of uninterrupted failed deliveries, or `null`. |
| `version` | Version; equals the `ETag` header. |
| `created_at`, `updated_at` | Timestamps. |

```json
{
  "id": "whe_01k8a3m5q7t9v1w3x5y7z9b2c4",
  "key": "crm-sync",
  "url": "https://hooks.example.com/keenauth",
  "description": "CRM sync",
  "event_types": ["user.created", "user.updated"],
  "event_schema_versions": {"user.created": 1},
  "payload_mode": "thin",
  "status": "enabled",
  "rate_limit_per_second": 50,
  "previous_secret_expires_at": null,
  "last_success_at": "2026-10-26T09:12:00Z",
  "failing_since": null,
  "version": 3,
  "created_at": "2026-10-26T09:00:00Z",
  "updated_at": "2026-10-26T10:00:00Z"
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 404 | `not_found` | No such endpoint in this environment (also for another environment's endpoint or a malformed ID). |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks `webhook-endpoints:read`. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | Webhook administration is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl -i https://api.eu.keenauth.com/v1/webhook-endpoints/whe_01k8a3m5q7t9v1w3x5y7z9b2c4 \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

CLI: `keenauth webhook-endpoints get whe_01k8a3m5q7t9v1w3x5y7z9b2c4`