> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# 获取 Webhook 配置 API：查询 Webhook 设置与事件

> Didit 帮您读取应用的 Webhook 设置，包括旧版 Webhook URL 与密钥、目标地址、可订阅事件、数据保留策略和钱包回跳域名。



获取 Webhook 配置 API 提示词
        将提示词复制到剪贴板



      
      

\<pre>

\`Read my Didit application's webhook configuration through the Management API.

Endpoint:
GET https://verification.didit.me/v3/webhook/

Authentication:
Use the x-api-key header with my Didit API key. A scoped API key needs webhooks: read.

Goal:
\- Get every setting that controls how Didit sends webhooks for my application, plus the data-retention policy and the Digital ID wallet return hosts, in one call. Use it to audit the setup or to show the current configuration in a back office.

Behavior:
\- Didit delivers webhooks to webhook destinations (/v3/webhook/destinations/). Each destination has its own url, webhook_version, secret_shared_key and subscribed_events.
\- webhook_url, webhook_version and secret_shared_key at the top level are the application-level (legacy) webhook. Didit uses them only while the application has no enabled destination, and then only for status.updated and data.updated.
\- Every create, update or delete of a destination sets webhook_url to the URL of the oldest enabled destination, or null when none is enabled.
\- API-key callers always receive the application secret and every destination secret in full.

Example call:
curl -X GET "https://verification.didit.me/v3/webhook/" \
-H "x-api-key: YOUR_API_KEY"

What to read from the response:
\- endpoints: every destination, oldest first, with uuid, label, url, enabled, webhook_version, secret_shared_key and subscribed_events. Verify each webhook with the secret of the destination it was sent to.
\- available_events: every event type you can subscribe a destination to ({ value, label }).
\- webhook_url, webhook_version, secret_shared_key: the legacy webhook, only relevant when no destination is enabled.
\- data_retention_months (null means no automatic deletion), face_retention_policy and face_retention_days: the retention policy.
\- allowed_return_hosts: hosts a Digital ID wallet verification may send the person back to.
\- allowed_domains: web origins the hosted verification flow may be embedded in and may send the user back to; empty means no restriction.
\- capture_method: MOBILE or MOBILE_AND_DESKTOP. A legacy setting with no effect; capture options are set per workflow.

Failure modes:
\- 401: { "detail": "This API key has expired." }
\- 403: { "detail": "You do not have permission to perform this action." } for a missing key (a wrong, revoked or expired key gets 401); { "detail": "This API key has no read access to webhooks." } for a scoped key without webhooks: read.
\- 429: more than 600 GET requests per minute with this key; wait for Retry-After.

Side effects: none. This is a pure read, and the response contains signing secrets: never log it.

For the full integration shape, see /integration/integration-prompt.`

\</pre>



      
      

粘贴到

此端点返回在 Webhook 目标推出之前设置的应用级 Webhook，以及目标列表。Didit 会将 Webhook 投递到您的[Webhook 目标](https://docs.didit.me/zh/management-api/webhook/list-destinations.md)，每个目标都使用其自身的 `secret_shared_key` 签名。顶层的 `webhook_url`、`webhook_version` 和 `secret_shared_key` 仅在没有启用任何目标时使用，且仅用于 `status.updated` 和 `data.updated` 事件。> [!WARNING]
>
> 响应包含您应用的所有签名密钥。请勿将响应内容记录到日志中，也不要将其放入客户端代码中。如需修改这些设置，请使用[更新 Webhook 配置](https://docs.didit.me/zh/management-api/webhook/update-config.md)。有关签名验证和payload的说明，请参阅 [Webhook 指南](https://docs.didit.me/zh/integration/webhooks.md)。有关保留期字段，请参阅[数据保留](https://docs.didit.me/zh/console/data-retention.md)。


## OpenAPI

````yaml zh/openapi-25.json GET /v3/webhook/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/webhook/:
    get:
      tags:
        - Webhook
      summary: 获取 Webhook 配置
      description: >-
        通过一次调用返回应用的 Webhook 设置：每个 [Webhook
        目标](https://docs.didit.me/zh/management-api/webhook/list-destinations)及其签名密钥、目标可以订阅的事件类型、应用级别（旧版）Webhook
        URL、版本和密钥、数据及生物特征模板保留策略，以及数字身份钱包返回主机。Didit 会将 Webhook
        投递到各个目标，每个目标都使用其专属的 `secret_shared_key` 进行签名；顶层的
        `webhook_url`、`webhook_version` 和 `secret_shared_key` 仅在未启用任何目标时使用，且仅用于
        `status.updated` 和 `data.updated`。响应中包含签名密钥，因此请勿将其记录在日志或客户端代码中。限定范围的 API
        密钥需要 `webhooks: read` 权限。
      operationId: get_webhook_config
      parameters: []
      responses:
        '200':
          description: Webhook 配置。
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookConfig'
              examples:
                One destination:
                  value:
                    webhook_url: https://yourapp.com/webhooks/didit
                    webhook_version: v3
                    secret_shared_key: dGhpcy1pcy10aGUtYXBwLWxldmVsLXNlY3JldC0wMDA
                    capture_method: MOBILE
                    data_retention_months: 24
                    face_retention_policy: delete_with_session
                    face_retention_days: null
                    biometric_consent_mode: auto
                    available_events:
                      - value: status.updated
                        label: Session status updated
                      - value: data.updated
                        label: Session data updated
                      - value: user.status.updated
                        label: User status updated
                      - value: user.data.updated
                        label: User data updated
                      - value: business.status.updated
                        label: Business status updated
                      - value: business.data.updated
                        label: Business data updated
                      - value: activity.created
                        label: Activity created
                      - value: transaction.created
                        label: Transaction created
                      - value: transaction.status.updated
                        label: Transaction status updated
                      - value: travel_rule.status.updated
                        label: Travel Rule Status Updated
                      - value: workflow.compliance_changed
                        label: Workflow Compliance Changed
                    allowed_return_hosts:
                      - shop.example.com
                    endpoints:
                      - uuid: 11111111-2222-3333-4444-555555555555
                        label: Production session webhooks
                        url: https://yourapp.com/webhooks/didit
                        enabled: true
                        webhook_version: v3
                        secret_shared_key: dGhpcy1pcy1hbi1leGFtcGxlLXNlY3JldC0wMDAwMDA
                        subscribed_events:
                          - status.updated
                          - data.updated
                        created_at: '2026-01-04T08:00:00.000000Z'
                        updated_at: '2026-04-22T14:09:11.523671Z'
        '401':
          description: API 密钥已过期：它在创建时设置的到期日期已过。错误或已撤销的密钥也会收到 `401`；缺失密钥则收到 `403`。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Expired key:
                  value:
                    detail: This API key has expired.
        '403':
          description: >-
            该请求不被允许。缺失、无效或已撤销的 `x-api-key` 会收到 `You do not have permission to
            perform this action.`。缺少此 endpoint 所需访问权限的限定作用域密钥会收到指明所缺权限的消息，而在其 IP
            白名单之外使用的密钥会收到 `This API key can't be used from this IP address.`。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Missing or invalid key:
                  value:
                    detail: You do not have permission to perform this action.
                Scoped key without webhooks read:
                  value:
                    detail: This API key has no read access to webhooks.
                Outside the IP allowlist:
                  value:
                    detail: This API key can't be used from this IP address.
        '429':
          description: 超出速率限制：当前一分钟窗口内该 API 密钥的 GET 请求超过 600 次。请等待 `Retry-After` 秒后再重试。
          headers:
            Retry-After:
              description: 重试前需要等待的秒数。
              schema:
                type: integer
                minimum: 1
                example: 30
            X-RateLimit-Limit:
              description: 一分钟时间窗口内允许的请求数（600）。
              schema:
                type: integer
                example: 600
            X-RateLimit-Remaining:
              description: 当前时间窗口内剩余的请求数。
              schema:
                type: integer
                example: 0
            X-RateLimit-Reset:
              description: 当前窗口重置的 Unix 时间（秒）。
              schema:
                type: integer
                example: 1792056120
            X-RateLimit-Scope:
              description: 发生超支的预算名称。
              schema:
                type: string
                example: generic-get
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Throttled:
                  value:
                    detail: >-
                      GET request rate limit exceeded. You can make up to 600
                      requests per minute.
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: |-
            curl -X GET 'https://verification.didit.me/v3/webhook/' \
              -H 'x-api-key: YOUR_API_KEY'
        - lang: python
          label: Python
          source: |-
            from didit import Didit

            # Reads DIDIT_API_KEY.
            client = Didit()

            result = client.webhooks.retrieve_config()
            print(result)
        - lang: javascript
          label: Node.js
          source: |-
            import Didit from "@didit-protocol/sdk-node";

            // Reads DIDIT_API_KEY.
            const didit = new Didit();

            const result = await didit.webhooks.retrieveConfig();
            console.log(result);
        - lang: go
          label: Go
          source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Webhooks.RetrieveConfig(ctx)\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)"
        - lang: java
          label: Java
          source: |-
            import me.didit.Didit;

            // Reads DIDIT_API_KEY.
            Didit client = new Didit();

            var result = client.webhooks().retrieveConfig();
            System.out.println(result);
        - lang: php
          label: PHP
          source: |-
            <?php

            require 'vendor/autoload.php';

            use Didit\DiditClient;

            // Reads DIDIT_API_KEY.
            $didit = new DiditClient();

            $result = $didit->webhooks->retrieveConfig();
            print_r($result->toArray());
        - lang: ruby
          label: Ruby
          source: |-
            require "didit"

            # Reads DIDIT_API_KEY.
            didit = Didit::Client.new

            result = didit.webhooks.retrieve_config
            puts result.to_h
        - lang: csharp
          label: .NET
          source: |-
            using System;
            using System.Text.Json;
            using Didit;

            // Reads DIDIT_API_KEY.
            using var client = new DiditClient();

            var result = await client.Webhooks.RetrieveConfigAsync();
            Console.WriteLine(JsonSerializer.Serialize(result));
components:
  schemas:
    WebhookConfig:
      type: object
      description: 应用级 Webhook 配置、保留策略和数字身份（Digital ID）钱包返回主机，以及所有 Webhook 目标。
      required:
        - webhook_url
        - webhook_version
        - secret_shared_key
        - capture_method
        - data_retention_months
        - face_retention_policy
        - face_retention_days
        - available_events
        - allowed_return_hosts
        - endpoints
      properties:
        webhook_url:
          type: string
          format: uri
          nullable: true
          description: >-
            应用级（旧版）Webhook URL。Didit 仅在应用没有已启用的目标时才向其发送事件，且仅发送 `status.updated`
            和 `data.updated`。每次创建、更新或删除目标时，都会将其设置为最早启用的目标的 URL；若无已启用的目标，则设置为
            `null`。
        webhook_version:
          type: string
          enum:
            - v1
            - v2
            - v3
          description: 传统 `webhook_url` 的 payload 版本。每个目标都有其独立的 `webhook_version`。
        secret_shared_key:
          type: string
          description: >-
            应用级签名密钥（43 字符的 URL 安全 token）。它仅对投递到旧版 `webhook_url`
            的事件进行签名；每个目标则使用各自的 `secret_shared_key` 进行签名。通过 API
            密钥调用的调用方始终会完整接收该密钥；没有 `read:webhooks` 权限的控制台用户将收到空字符串。
        capture_method:
          type: string
          enum:
            - MOBILE
            - MOBILE_AND_DESKTOP
          description: 旧版应用设置。验证流程不会读取它：采集选项按工作流进行配置。
        data_retention_months:
          type: integer
          nullable: true
          minimum: 1
          maximum: 120
          description: >-
            自动删除窗口。在此月数以前（一个月按 30 天计算）创建的用户验证会话将被自动删除，且该删除不可逆。`null`
            表示会话绝不会被自动删除。参见[数据保留](https://docs.didit.me/zh/console/data-retention)。
        face_retention_policy:
          type: string
          enum:
            - delete_with_session
            - retain_until_user_deleted
          description: >-
            当会话被删除时，对该会话的人脸特征向量的处理方式。`delete_with_session`（默认）会随会话一同将其删除。`retain_until_user_deleted`
            为自选的[生物特征模板保留](https://docs.didit.me/zh/console/data-retention#生物特征模板保留)：与用户关联的不含图像的生物特征模板会被单独管理，直至其数据保留期结束、用户被删除或您主动清除它。
        face_retention_days:
          type: integer
          nullable: true
          minimum: 1
          maximum: 3650
          description: 在 `retain_until_user_deleted` 策略下生物特征模板的保留期（以天为单位）。设置该策略时必填。
        biometric_consent_mode:
          type: string
          enum:
            - auto
            - always
            - never
          description: >-
            托管流程和原生 SDK
            何时在人脸采集前向当事人请求明确的生物识别同意。`auto`（默认）仅在适用触发条件时请求：当事人声明的州、当事人的 IP
            或身份证件签发地位于伊利诺伊州、德克萨斯州或科罗拉多州，或者当事人看似位于美国境内且所在州未知。`always`
            会向工作流中需要采集人脸的每个人请求。`never`
            则从不显示该步骤，由您在拍摄自拍照前自行收集同意。每次更改都会记录在审计日志中。请参阅[生物识别同意](https://docs.didit.me/zh/getting-started/biometric-consent)。
        available_events:
          type: array
          description: 目标可以订阅的每种事件类型，附带显示标签。
          items:
            type: object
            required:
              - value
              - label
            properties:
              value:
                $ref: '#/components/schemas/WebhookEvent'
              label:
                type: string
                description: 显示标签，例如 `Session status updated`。
        allowed_return_hosts:
          type: array
          maxItems: 20
          description: >-
            独立数字身份钱包验证可通过其 `return_url` 将用户送回的主机名（精确匹配，仅限
            HTTPS）。您的白标域名也始终被允许。请参阅[注册您的返回目标](https://docs.didit.me/zh/standalone-apis/digital-id-wallets#注册返回目标)。
          items:
            type: string
            maxLength: 253
        endpoints:
          type: array
          description: >-
            该应用的每个 Webhook 目标，按时间正序排列，每个目标均附带其签名密钥。此处为只读：使用
            `/v3/webhook/destinations/` 系列 endpoint 管理目标。
          items:
            $ref: '#/components/schemas/WebhookConfigDestination'
        allowed_domains:
          type: array
          maxItems: 50
          items:
            type: string
            maxLength: 300
          description: >-
            托管验证流程可以嵌入并可通过会话回调将用户重定向回的源（Origin，例如
            `https://app.example.com`；`http` 仅适用于
            `localhost`）。服务器到服务器的调用不受影响。空列表表示无限制。Didit
            会将每个源以小写形式存储，且不包含默认端口。无效条目将导致 `allowed_domains` 验证失败并返回 `400`。
          example:
            - https://app.example.com
    WebhookEvent:
      type: string
      description: 支持的 Webhook 事件名称。请在 `subscribed_events` 中使用这些完全匹配的字符串；不支持的值将被拒绝。
      enum:
        - status.updated
        - data.updated
        - user.status.updated
        - user.data.updated
        - business.status.updated
        - business.data.updated
        - activity.created
        - transaction.created
        - transaction.status.updated
        - travel_rule.status.updated
        - workflow.compliance_changed
        - transaction_rule_suggestions.created
        - auth.signup
        - auth.login
        - auth.login_failed
        - auth.password_reset_requested
        - auth.password_reset_completed
        - auth.mfa_changed
        - auth.new_device
        - auth.account_locked
        - investigator.report.ready
        - investigator.decision.automated
        - investigator.decision.overridden
        - investigator.decision.contested
        - investigator.question.raised
        - investigator.automation.paused
        - investigator.rfi.answered
        - investigator.rfi.overdue
        - investigator.drift.detected
        - investigator.sla.breached
        - investigator.qa.failed
        - investigator.external.report.ready
    WebhookConfigDestination:
      type: object
      description: >-
        Webhook 配置中列出的 Webhook 目标，不包含投递指标。`GET
        /v3/webhook/destinations/{destination_uuid}/` 会附加其投递摘要。
      required:
        - uuid
        - label
        - url
        - enabled
        - webhook_version
        - secret_shared_key
        - subscribed_events
        - created_at
        - updated_at
      properties:
        uuid:
          type: string
          format: uuid
          description: 目标 ID。
        label:
          type: string
          maxLength: 255
          description: 易于阅读的名称。
        url:
          type: string
          format: uri
          maxLength: 2000
          description: Didit 发送事件通知的 HTTPS endpoint。
        enabled:
          type: boolean
          description: '`false` 会暂停向此目标投递。'
        webhook_version:
          type: string
          enum:
            - v1
            - v2
            - v3
          description: 发送至该目标的 payload 版本。
        secret_shared_key:
          type: string
          description: >-
            此目标的签名密钥（43 字符的 URL 安全 token）。请使用发送该 Webhook 的目标的密钥来验证每个 Webhook。使用
            API 密钥调用的调用方始终会接收完整密钥；没有 `read:webhooks` 权限的控制台用户将收到空字符串。
        subscribed_events:
          type: array
          uniqueItems: true
          description: 投递至此目标的事件类型。如果目标创建时未指定事件，则为空，在此情况下它不会接收任何内容。
          items:
            $ref: '#/components/schemas/WebhookEvent'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        您的应用 API 密钥，可在 Business Console 的“开发者 -> API
        密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于
        IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP
        列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF
        URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅
        https://docs.didit.me/console/api-keys。

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.