Retrieve a webhook
Returns one endpoint with its configuration and health: is_active, disabled_reason,
consecutive_failures and the status of the latest delivery. The secret is never returned; custom
header values are masked as "[configured]"; members below admin see only the URL’s origin.
An automatically disabled endpoint has is_active: false with disabled_reason: consecutive_failures (20 consecutive failed deliveries spanning at least 24 hours) or gone (the
endpoint returned 410). Re-enable it with POST /api/webhooks/{webhookId}/enable.
Idempotency. A read with no side effects. Safe to retry.
Access
- Required scope:
readorwrite. Any workspace role can call it. - Rate limit: General API — 120 requests/min per workspace on Starter or with no active plan, 200 on Growth, 300 on Business, 600 on Enterprise. See Rate limits.
- Plan: Available on every plan and also without an active subscription. See Billing and usage.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.
Path parameters
UUID of the outbound webhook endpoint, returned as id by GET /api/webhooks. It must belong to the authenticated workspace; an id from another workspace, an unknown id or a value that is not a UUID answers 404.
Response
An outbound webhook endpoint as returned by the API. The signing secret is never included; it is
returned once by POST /api/webhooks (as an additional secret field) and by rotate-secret.
Custom headers keep their names, but every value is "[configured]". Members below admin (and
API keys without the full scope) see only the origin of url.