---
title: "Get a workflow's webhook address and secret"
description: "For a workflow of the app whose trigger is `webhook()`."
canonical: "https://grid82.com/docs/builder-api/workflows/webhook-get"
updated: "2026-11-13"
---

# Get a workflow's webhook address and secret

`GET https://studio.grid82.app/v1/apps/{appId}/workflows/{workflowId}/webhook`

For a workflow of the app whose trigger is `webhook()`.

The secret is created on first read. A POST to the address starts a run when the workflow is active: signed (Standard Webhooks) or with the secret as a bearer token, JSON body of the declared inputs, 64 KB at most; it answers 202 with the run's id, or 400 if an input is missing or wrong.

Requires the `workflows:write` scope. Operation `workflows.webhook.get`. MCP tool `workflows_webhook_get`. CLI: `grid82 workflows webhook get` (`npx grid82`).

## Path parameters

| Name         | Type   | Required | Description |
| ------------ | ------ | -------- | ----------- |
| `appId`      | string | yes      |             |
| `workflowId` | string | yes      |             |

**Authorizations**

- `Authorization` (bearer, in header, required)

## Response

**200**: Success

- `data` (`object`, required)
- `data.url` (`string,null`, required)
- `data.secret` (`string`, required)

```json
{
  "data": {
    "url": null,
    "secret": "<string>"
  }
}
```

**4XX**: Refused

- `error` (`object`, required)
- `error.code` (`enum<string>`, required, one of: `not_found, forbidden, unauthenticated, validation_failed, conflict, rate_limited, payment_required, not_implemented, internal`)
- `error.message` (`string`, required)
- `error.details` (`Record<string, unknown>`)

```json
{
  "error": {
    "code": "not_found",
    "message": "<string>",
    "details": {}
  }
}
```

**Example request**

```bash
curl --request GET \
  --url 'https://studio.grid82.app/v1/apps/<appId>/workflows/<workflowId>/webhook' \
  --header 'Authorization: Bearer <token>'
```