> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hopae.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Webhook Config

> Retrieve webhook configuration for an app.

Returns the webhook delivery configuration for an app.

## Request

<ParamField header="Authorization" type="string" required>
  `Bearer <API_KEY>` from Console > Developers > Workspace API Keys.
</ParamField>

### Path parameters

<ParamField path="client_id" type="string" required>
  Client identifier of the app.
</ParamField>

## Response

<ResponseField name="url" type="string">
  Destination URL for webhook delivery.
</ResponseField>

<ResponseField name="enabled" type="boolean">
  Whether webhooks are sent.
</ResponseField>

<ResponseField name="retryAttempts" type="number">
  Stored configuration value. The delivery pipeline currently uses a workspace-wide default (3 attempts at 1s / 5s / 30s) rather than this per-app value. Per-app override is on the roadmap.
</ResponseField>

<ResponseField name="timeoutSeconds" type="number">
  Stored configuration value. The delivery pipeline currently uses a workspace-wide default (10s). Per-app override is on the roadmap.
</ResponseField>

<ResponseField name="secret" type="string">
  Webhook signing secret.
</ResponseField>

<ResponseField name="events" type="string[]">
  Subscribed webhook events. See the [Webhook Event Types](/guides/webhook-signing#event-types) reference for the full list. Common values: `verification.created`, `verification.completed`, `verification.failed`, `verification.session.timed_out`, `verification.workflow.cancelled`.
</ResponseField>

<ResponseField name="_id" type="string">
  Webhook config identifier.
</ResponseField>

<RequestExample>
  ```bash theme={null}
  curl -H "Authorization: Bearer sk_workspace_test_..." \
    "https://sandbox.api.hopae.com/connect/v1/apps/abc123/webhook_config"
  ```
</RequestExample>

<ResponseExample>
  ```json theme={null}
  {
    "url": "https://hooks.example.com/hopae",
    "enabled": true,
    "retryAttempts": 3,
    "timeoutSeconds": 10,
    "secret": "",
    "events": [
      "verification.initiated",
      "verification.completed",
      "verification.awaiting_user_action",
      "verification.failed",
      "verification.expired",
      "verification.cancelled"
    ],
    "_id": "69c645e5756d7730ebef70ba"
  }
  ```
</ResponseExample>

<Info>
  Webhooks are signed via HMAC-SHA256 using the app’s webhook secret. Each delivery includes an
  `X-Hopae-Signature` header in the format `t=<unix-timestamp>,v1=<hex-hmac-sha256>`.
  See the [Webhook Signature Verification](/guides/webhook-signing) guide for verification code
  and replay-protection recommendations.
</Info>