Get inbound webhook

Returns the secret inbound address of an automation that starts from outside, and its filters. Anyone with the address can start the automation, so it needs the permission hooks:read_secret.

GET /v1/automations/{automation_id}/inbound-webhook

Permission	`hooks:read_secret` (all permissions)
Risk	Read
Idempotency-Key	Not needed (how it works)
Safe to repeat	Safe: the call only reads.
Rate limit class	`read` (120 requests per minute per key)
Confirmation	None
MCP tool	Not available in MCP
Since version	2026-10-25

#What it does

Only reads data. It changes nothing and sends nothing.

#Request

Path parameters

Name	Type	Description
`automation_id`	string	Automation ID.

#Examples

curlPythonTypeScript

curl "https://api.smartchat.marketing/v1/automations/aut_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/inbound-webhook" \
  -H "Authorization: Bearer $SMARTCHAT_API_KEY"

import os
import requests

response = requests.get(
    "https://api.smartchat.marketing/v1/automations/aut_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/inbound-webhook",
    headers={"Authorization": "Bearer " + os.environ["SMARTCHAT_API_KEY"]},
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://api.smartchat.marketing/v1/automations/aut_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/inbound-webhook", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SMARTCHAT_API_KEY}`,
  },
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());

Response (200):

{
  "object": "inbound_webhook",
  "automation_id": "aut_0f8c1a2e4b7d4c3e9a5b6d7e8f901234",
  "url": "https://api.example.invalid/public/automations/hook/EXAMPLE_TOKEN",
  "method": "POST",
  "trigger": "inbound_webhook",
  "filters": []
}

#Response

Status 200. Every response has the headers Request-Id, SmartChat-Version and X-RateLimit-*.

Name	Type	Description
`object`	string	Always "inbound_webhook". always `inbound_webhook`
`automation_id`	string	Automation ID.
`url`	string	The secret address. Treat it like a password. up to 600 characters
`method`	string	Always POST. always `POST`; up to 10 characters
`trigger`	string	The trigger type of the automation. up to 40 characters
`filters`	array of object	Filters of the trigger. up to 5 items
`filters[].path`	string	Path. up to 120 characters
`filters[].equals`	string	Value. up to 200 characters

#Errors

Code	Status	When
`api_key_expired`	401	This API key has expired.
`api_key_invalid`	401	This API key is not valid.
`api_key_revoked`	401	This API key was revoked.
`authentication_required`	401	No API key was sent. Send 'Authorization: Bearer <key>'.
`insufficient_scope`	403	This key lacks a required permission.
`ip_not_allowed`	403	This IP address is not allowed for this key.
`automation_not_found`	404	No automation with this ID exists in this account.
`conflict`	409	The state of the object does not allow this.
`validation_failed`	422	A field is not valid.
`rate_limited`	429	Too many requests. Wait and try again.
`internal_error`	500	Something went wrong on our side.

All errors use one format.