The public urls this flow's webhook triggers answer on

GET 
/api/flows/:flowId/webhooks

The only surface that can show the secret. The token rides on the trigger's own config so the url survives a save; the secret deliberately does not, because a flow definition is exportable as JSON and a shared secret in an export is one in somebody's downloads folder.

Request

Responses

200

One entry per active webhook trigger.

401

Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).

403

Authenticated but not allowed.