# Get Webhook Configuration API

- Anchor: `bankhub-en-api-api-webhook-thong-tin-webhook`
- URL: https://developer.sepay.vn/en/bankhub/api/api-webhook/thong-tin-webhook.md
- Description: API to retrieve the merchant’s current webhook configuration. Webhooks are used to receive event notifications from Bank Hub.

**GET** `https://bankhub-api-sandbox.sepay.vn/v1/webhook`
```http
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json
```



**Headers**

<!-- Params table -->

> **Note** (info)
>
>
> * This API requires a Bearer Token in the Authorization header
> * Returns the merchant’s current webhook configuration
> * If the webhook is not configured, returns `data: null`
> * The secret key is masked (shows the last 4 characters)
>






**RESPONSE 200 - Configured**


```json
{
  "data": {
    "webhook_url": "https://merchant.com/webhook",
    "auth_type": "SECRET_KEY",
    "secret_key": "***5678",
    "request_content_type": "application/json",
    "active": 1,
    "allow_events": ["BANK_ACCOUNT_LINKED", "BANK_ACCOUNT_UNLINKED"]
  }
}
```








---

### Usage Examples





---

> **Allow Events Configuration** (info)
>
> **How it works:**
>
> * `null` or `[]`: Do not send any events
> * `["*"]`: Send all 13 event types
> * `["BANK_ACCOUNT_LINKED", "BANK_ACCOUNT_UNLINKED"]`: Send only specific events
>
> **13 event types:**
>
> * Link Token: `LINK_TOKEN_CREATED`, `LINK_TOKEN_REVOKED`, `LINK_TOKEN_EXPIRED`
> * Link Session: `LINK_SESSION_INITIALIZED`, `LINK_SESSION_REINITIALIZED`, `LINK_SESSION_STATE_CHANGED`, `LINK_SESSION_COMPLETED`, `LINK_SESSION_FAILED`, `LINK_SESSION_ABANDONED`, `LINK_SESSION_EXPIRED`
> * Bank Account: `BANK_ACCOUNT_LINKED`, `BANK_ACCOUNT_UNLINKED`, `BANK_ACCOUNT_INACTIVATED`
>

> **Secret Key Display** (info)
>
>
> * In GET responses, the secret key is masked for security
> * Only the last 4 characters are shown: `***5678`
> * The full secret key is only returned when creating/updating via POST
>

> **Important Notes** (warn)
>
>
> * If `data` is `null`, the merchant has not configured a webhook
> * The secret key is masked in GET responses (shown as `***xxxx`)
> * `allow_events = null` or `[]` means the webhook will not send any events
> * If Active = 0, the webhook is disabled and will not send events even if `allow_events` is configured
>

---