Skip to main content
GET
curl
The response carries the same health fields as the list, plus a summary of the last 30 days.

Authorizations

x-api-key
string
header
required

Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is wrong, revoked or expired; 403 means no key was sent, the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.

Path Parameters

destination_uuid
string<uuid>
required

UUID of the destination (the uuid returned from create / list).

Response

Webhook destination details.

uuid
string<uuid>
label
string
url
string<uri>
enabled
boolean
webhook_version
enum<string>
Available options:
v1,
v2,
v3
secret_shared_key
string

HMAC signing secret (43-character URL-safe token). Always returned in full to API-key callers; Console users need read:webhooks, otherwise an empty string.

secret_last4
string

Last four characters of the destination's current signing secret, so you can tell secrets apart. Not enough to verify a signature.

previous_secret_expires_at
string<date-time> | null

Set for 24 hours after the destination's signing secret is rotated in the Business Console. Until this time, every delivery to the destination also carries X-Signature-Previous, X-Signature-V2-Previous and X-Signature-Simple-Previous, made with the replaced secret (see Signature verification). null when no rotation happened in the last 24 hours.

subscribed_events
enum<string>[]

Event filter for this webhook destination. Didit delivers only webhooks whose event type exactly matches one of these values — there is no wildcard subscription. When sent, the list must contain at least one valid event (an explicit [] is rejected with 400); a destination whose list is empty (field omitted at create) receives nothing. On update the list is replaced wholesale, never merged.

Minimum array length: 1

Supported webhook event name. Use these exact strings in subscribed_events; unsupported values are rejected.

Available options:
status.updated,
data.updated,
user.status.updated,
user.data.updated,
business.status.updated,
business.data.updated,
activity.created,
transaction.created,
transaction.status.updated,
travel_rule.status.updated,
workflow.compliance_changed,
transaction_rule_suggestions.created,
auth.signup,
auth.login,
auth.login_failed,
auth.password_reset_requested,
auth.password_reset_completed,
auth.mfa_changed,
auth.new_device,
auth.account_locked,
investigator.report.ready,
investigator.decision.automated,
investigator.decision.overridden,
investigator.decision.contested,
investigator.question.raised,
investigator.automation.paused,
investigator.rfi.answered,
investigator.rfi.overdue,
investigator.drift.detected,
investigator.sla.breached,
investigator.qa.failed,
investigator.external.report.ready
Example:
created_by_email
string | null

Email of the Business Console member who created the destination. null for a destination created with an API key.

created_by_name
string | null

Name of the Business Console member who created the destination. null for a destination created with an API key.

created_at
string<date-time>
updated_at
string<date-time>
health_status
enum<string>

Delivery health. failing: 3 or more consecutive events failed their first delivery attempt since the destination last answered successfully (see failing_streak). degraded: not failing, but a delivery attempt failed in the last 24 hours and no later attempt has delivered that event; a retry or resend that delivers it clears this. healthy: neither. Independent of enabled. A failed attempt is one answered with HTTP 400 or above, or not answered at all.

Available options:
healthy,
degraded,
failing
failing_streak
integer

How many consecutive events failed their first delivery attempt since the destination last answered successfully, within the last 30 days. Retries are not counted, and any successful attempt, including a retry or a resend, ends the streak. 0 when no event has failed since the last success.

failing_since
string<date-time> | null

When the first failed attempt of the current failing_streak was made. null when failing_streak is 0.

last_success_at
string<date-time> | null

When the destination last answered a delivery with an HTTP status under 400, within the last 30 days. null if it has not in that window.

environment
enum<string>

Environment of the application that owns the destination.

Available options:
live,
sandbox
summary
object

Delivery metrics for the last metrics_window_days (30) days. last_delivery_at is the most recent attempt, whenever it was made.

Last modified on November 1, 2026