> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /api/external/webhooks — Get your webhook endpoint

> Your app’s webhook endpoint, its events and the last 20 deliveries (with status codes and errors) — the first place to look when an event seems missing.

- Source: https://www.dropfans.io/developers/reference/get-webhook
- Section: API reference
- OpenAPI: https://www.dropfans.io/developers/openapi.json

Your app’s webhook endpoint, its events and the last 20 deliveries (with status codes and errors) — the first place to look when an event seems missing.

## Authentication

`Authorization: Bearer dpfn_...` — an API key generated in the creator's dashboard (Vault → API Connect). One key = one creator. Missing or invalid keys return 401 `{"error":"Unauthorized","code":"unauthorized"}`.

## Responses

### 200

The configuration.

| Field | Type | Required | Description |
|---|---|---|---|
| `url` | string \\| null |  | Your https endpoint, or null when none is set. |
| `events` | string[] | yes | Events delivered to the endpoint. |
| `hasSecret` | boolean | yes | Whether a signing secret exists. |
| `availableEvents` | string[] | yes | Every event you can subscribe to. |
| `recentDeliveries` | object[] | yes | The last 20 deliveries, newest first. |

```json
{
  "url": "https://crm.example.com/hooks/dropfans",
  "events": [
    "drop.paid",
    "drop.refunded",
    "account.kyc_updated"
  ],
  "hasSecret": true,
  "availableEvents": [
    "drop.paid",
    "drop.refunded",
    "account.kyc_updated"
  ],
  "recentDeliveries": [
    {
      "id": "evt_2b7c…",
      "event": "drop.paid",
      "status": "DELIVERED",
      "attempts": 1,
      "lastStatusCode": 200,
      "lastError": null,
      "createdAt": "2026-10-17T16:20:01.000Z",
      "deliveredAt": "2026-10-17T16:20:01.000Z",
      "nextAttemptAt": null
    }
  ]
}
```

## Errors

| Status | Body | When |
|---|---|---|
| 401 | `{"error":"Unauthorized","code":"unauthorized"}` | Missing or invalid API key. |
| 403 | `{"error":"This endpoint needs a key bound to an approved app.","code":"app_key_required"}` | A Personal key was used. |
| 403 | `{"error":"Use the app owner's key for this endpoint.","code":"owner_key_required"}` | The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators. |

## Rate limiting

Per-key fixed windows by tier (Personal 60/min · 5,000/day; approved apps 300/min · 50,000/day; Dropfans-operated integrations exempt). Read the live values from X-RateLimit-Tier, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and their -Day variants; a 429 carries Retry-After and `{"error":"Rate limit exceeded","code":"rate_limited"}`. See [Rate limits](https://www.dropfans.io/developers/concepts/rate-limits.md).

## Code samples

### curl

```bash
curl "https://www.dropfans.io/api/external/webhooks" \
  -H "Authorization: Bearer $DROPFANS_API_KEY"
```

### Node

```javascript
const res = await fetch(`https://www.dropfans.io/api/external/webhooks`, {
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
  },
});
console.log(await res.json());
```

### Python

```python
import os
import requests

res = requests.get(
    "https://www.dropfans.io/api/external/webhooks",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
)
print(res.json())
```

## OpenAPI

```json
{
  "method": "GET",
  "path": "/api/external/webhooks",
  "operationId": "getWebhook",
  "tags": [
    "crm"
  ],
  "summary": "Get your webhook endpoint",
  "description": "Your app’s webhook endpoint, its events and the last 20 deliveries (with status codes and errors) — the first place to look when an event seems missing.",
  "responses": {
    "200": {
      "description": "The configuration.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "url": {
                "type": [
                  "string",
                  "null"
                ],
                "description": "Your https endpoint, or null when none is set.",
                "format": "uri"
              },
              "events": {
                "type": "array",
                "items": {
                  "type": "string",
                  "description": "Event type."
                },
                "description": "Events delivered to the endpoint."
              },
              "hasSecret": {
                "type": "boolean",
                "description": "Whether a signing secret exists."
              },
              "availableEvents": {
                "type": "array",
                "items": {
                  "type": "string",
                  "description": "Event type."
                },
                "description": "Every event you can subscribe to."
              },
              "recentDeliveries": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "id": {
                      "type": "string",
                      "description": "Event id (also the DropFans-Event-Id header)."
                    },
                    "event": {
                      "type": "string",
                      "description": "Event type."
                    },
                    "status": {
                      "type": "string",
                      "description": "PENDING = retrying.",
                      "enum": [
                        "PENDING",
                        "DELIVERED",
                        "FAILED"
                      ]
                    },
                    "attempts": {
                      "type": "integer",
                      "description": "Attempts so far."
                    },
                    "lastStatusCode": {
                      "type": [
                        "integer",
                        "null"
                      ],
                      "description": "Your endpoint’s last HTTP status."
                    },
                    "lastError": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "Last failure reason."
                    },
                    "createdAt": {
                      "type": "string",
                      "description": "When the event was created.",
                      "format": "date-time"
                    },
                    "deliveredAt": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "When your endpoint accepted it.",
                      "format": "date-time"
                    },
                    "nextAttemptAt": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "Next retry, while PENDING.",
                      "format": "date-time"
                    }
                  },
                  "description": "One delivery."
                },
                "description": "The last 20 deliveries, newest first."
              }
            },
            "required": [
              "events",
              "hasSecret",
              "availableEvents",
              "recentDeliveries"
            ]
          },
          "example": {
            "url": "https://crm.example.com/hooks/dropfans",
            "events": [
              "drop.paid",
              "drop.refunded",
              "account.kyc_updated"
            ],
            "hasSecret": true,
            "availableEvents": [
              "drop.paid",
              "drop.refunded",
              "account.kyc_updated"
            ],
            "recentDeliveries": [
              {
                "id": "evt_2b7c…",
                "event": "drop.paid",
                "status": "DELIVERED",
                "attempts": 1,
                "lastStatusCode": 200,
                "lastError": null,
                "createdAt": "2026-10-17T16:20:01.000Z",
                "deliveredAt": "2026-10-17T16:20:01.000Z",
                "nextAttemptAt": null
              }
            ]
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid API key.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Unauthorized",
            "code": "unauthorized"
          }
        }
      }
    },
    "403": {
      "description": "A Personal key was used. Also: The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "This endpoint needs a key bound to an approved app.",
            "code": "app_key_required"
          }
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded for the current minute or day window. Wait Retry-After seconds and retry.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "Retry-After": {
          "description": "Seconds to wait before retrying (sent with 429s).",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Rate limit exceeded",
            "code": "rate_limited"
          }
        }
      }
    }
  },
  "x-codeSamples": [
    {
      "lang": "cURL",
      "label": "curl",
      "source": "curl \"https://www.dropfans.io/api/external/webhooks\" \\\n  -H \"Authorization: Bearer $DROPFANS_API_KEY\""
    },
    {
      "lang": "JavaScript",
      "label": "Node",
      "source": "const res = await fetch(`https://www.dropfans.io/api/external/webhooks`, {\n  headers: {\n    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,\n  },\n});\nconsole.log(await res.json());"
    },
    {
      "lang": "Python",
      "source": "import os\nimport requests\n\nres = requests.get(\n    \"https://www.dropfans.io/api/external/webhooks\",\n    headers={\"Authorization\": f\"Bearer {os.environ['DROPFANS_API_KEY']}\"},\n)\nprint(res.json())"
    }
  ],
  "x-dropfans-docs": "https://www.dropfans.io/developers/reference/get-webhook"
}
```

---

Previous: [Get a fresh ID-check link](https://www.dropfans.io/developers/reference/create-kyc-session.md) · Next: [Set your webhook endpoint](https://www.dropfans.io/developers/reference/set-webhook.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)