Get the webhook signing secret
The signing secret for your organization's webhook deliveries.
The signing secret for your organization's webhook deliveries.
Every delivery that does not carry a subscription-level secret — which
includes every dashboard Custom Webhook — is signed with this key.
Fetch it once, store it in your endpoint's configuration, and verify
X-Graine-Signature on each delivery; the error-handling guide has
runnable Node and Python.
Minted on first read if the organization does not have one yet, and stable afterwards: reading it never rotates it, so calling this twice — or a teammate calling it later — returns the same value your endpoint already verifies with.
Requires webhooks:write, deliberately. Holding this value is the
ability to forge a delivery to your own endpoints, so a read-only
reporting key must not be able to fetch it.
Rate limit: 1000 requests per minute per organization (bucket default). Exceeding it returns 429 with Retry-After; the X-RateLimit-* response headers report your remaining allowance on every call.
v2/webhooks/signing-secretAuthorization
AuthorizationRequiredBearer <token>
Your Graine API key. Create one in the dashboard under Developers, or via POST /v2/api-keys. Send it as Authorization: Bearer <key>.
In: header
Query Parameters
organization_idOrganization Id
Must match the organisation the API key belongs to.
Response Body
200
The secret every unsecreted delivery is signed with.
secretRequiredSecret
The HMAC-SHA256 key deliveries to your endpoints are signed with. Verify X-Graine-Signature against it — see the webhook error-handling guide for runnable examples. Treat it like a password: anyone holding it can forge a delivery to you.
applies_toApplies To
Always 'organization'. This key signs every delivery that does not carry a per-subscription secret of its own — including the dashboard Custom Webhook, which cannot carry one.
"organization"400
1000 — malformed input the schema could not reject: an unknown event type, a method other than POST/PUT, a reserved header name, or a callback_url pointing at a private, loopback or metadata address.
errorRequiredError
Stable integer code from the /v2 error table. Branch on this.
messageRequiredMessage
One human-readable sentence. Wording may change; the code will not.
401
1100 — missing, unknown or inactive API key. 1101 — a browser session token was presented instead of a gat_ key.
errorRequiredError
Stable integer code from the /v2 error table. Branch on this.
messageRequiredMessage
One human-readable sentence. Wording may change; the code will not.
403
1102 — the key is valid but lacks the scope this endpoint requires, or names another organisation. GET /v2/scopes reports which scopes the key holds.
errorRequiredError
Stable integer code from the /v2 error table. Branch on this.
messageRequiredMessage
One human-readable sentence. Wording may change; the code will not.
422
1001 — the body or query failed validation; the message names the first offending field.
errorRequiredinteger
Stable integer code from the error table. Branch on this, not on the message.
messageRequiredstring
One human-readable sentence. Wording may change; the code will not.
429
1300 — per-organisation rate limit exceeded. Carries Retry-After.
errorRequiredError
Stable integer code from the /v2 error table. Branch on this.
messageRequiredMessage
One human-readable sentence. Wording may change; the code will not.
504
1502 — an upstream did not respond in time.
errorRequiredError
Stable integer code from the /v2 error table. Branch on this.
messageRequiredMessage
One human-readable sentence. Wording may change; the code will not.
The secret every unsecreted delivery is signed with.