> ## Documentation Index > Fetch the complete documentation index at: https://docs.zebratruth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve the tenant's video webhook signing secret > Returns the tenant-level HMAC signing secret used to sign outbound video webhook payloads. **Auto-creates the secret on the first call** and persists it — subsequent calls return the same value. **Verification.** Use this secret in your webhook receiver to verify the `x-zt-webhook-signature` header on each delivery: ``` signature == HMAC_SHA256(secret, "POST" + "\n" + url + "\n" + timestamp + "\n" + sha256(body)) ``` The signature is computed once at delivery enqueue and stays stable across all retries for a given delivery — so your verifier sees the same signature regardless of which attempt arrives. **One-time visibility.** This is the ONLY surface that returns the secret. It never appears in `POST /compliance/check-video` responses or anywhere else. Treat it like an API key; store it in your secret manager. ## OpenAPI ````yaml /openapi/zebratruth-v1.yaml get /compliance/webhooks/video/secret openapi: 3.1.0 info: title: ZebraTruth Compliance API version: 1.0.0 description: > AI-powered compliance checking for advertising content. Check text and images against jurisdiction laws, platform policies, and rights clearance requirements. Results include embeddable annotations mapped to content locations (text spans, video timestamps, image regions). contact: name: ZebraTruth Support email: support@zebratruth.ai url: https://developers.zebratruth.ai license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.zebratruth.ai/v1 description: Production security: - bearerAuth: [] tags: - name: Video Compliance description: > **Primary endpoint.** Async compliance analysis for video ads. 3-step flow: get an upload URL, upload the video bytes, submit for analysis. Poll or receive an HMAC-signed webhook with the report. Returns timestamped findings citing stable evidence IDs (`audio_NNN`, `frame_NNN`, `ocr_NNN`, `signal_NNN`). 3-180 second videos. mp4 / webm / quicktime. Built for ad agencies and creators. - name: Authentication description: Validate API keys and check account status - name: Compliance description: >- Run compliance checks on text + image content (sync). For video, use the Video Compliance endpoints above. - name: Agents description: Discover and invoke individual compliance agents - name: Jobs description: Poll async job status and view execution traces - name: Reports description: Retrieve and replay compliance reports - name: Observability description: Request logs and webhook delivery status - name: Billing description: Subscriptions, plan changes, and credit balance - name: Documents description: Extract text from PDF and Word documents before or as part of a check - name: Check History description: List and retrieve past compliance checks for the workspace - name: Provenance description: Inspect and sign Content Credentials (C2PA) on images and video - name: Corpus description: >- Review queue for proposed changes to the governed legal corpus (dashboard session) - name: Webhooks description: Saved webhook endpoints (dashboard session) and delivery logs paths: /compliance/webhooks/video/secret: get: tags: - Video Compliance summary: Retrieve the tenant's video webhook signing secret description: | Returns the tenant-level HMAC signing secret used to sign outbound video webhook payloads. **Auto-creates the secret on the first call** and persists it — subsequent calls return the same value. **Verification.** Use this secret in your webhook receiver to verify the `x-zt-webhook-signature` header on each delivery: ``` signature == HMAC_SHA256(secret, "POST" + "\n" + url + "\n" + timestamp + "\n" + sha256(body)) ``` The signature is computed once at delivery enqueue and stays stable across all retries for a given delivery — so your verifier sees the same signature regardless of which attempt arrives. **One-time visibility.** This is the ONLY surface that returns the secret. It never appears in `POST /compliance/check-video` responses or anywhere else. Treat it like an API key; store it in your secret manager. operationId: getVideoWebhookSecret responses: '200': description: Secret retrieved (or just-created on first call) content: application/json: schema: $ref: '#/components/schemas/VideoWebhookSecretResponse' '401': $ref: '#/components/responses/Unauthorized' '404': description: Tenant not found components: schemas: VideoWebhookSecretResponse: type: object required: - secret - justGenerated - createdAt properties: secret: type: string description: >- HMAC signing secret. Format `whsec_<48 lowercase hex>`. Store in your secret manager — this is the only surface that returns it. pattern: ^whsec_[0-9a-f]{48}$ example: whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6 justGenerated: type: boolean description: >- True on the first-ever call for this tenant. False on every subsequent read. createdAt: type: string format: date-time responses: Unauthorized: description: | Invalid, missing, or expired API key. Standard error envelope — read `message` for the human-readable reason. content: application/json: schema: type: object description: Standard error envelope. required: - statusCode - message properties: error: type: boolean example: true url: type: string format: uri example: https://api.zebratruth.ai/v1/whoami statusCode: type: integer example: 401 statusMessage: type: string example: Invalid API key message: type: string description: Canonical human-readable reason — pattern-match on this field. example: Invalid API key securitySchemes: bearerAuth: type: http scheme: bearer description: | API key starting with `zt_live_` (production) or `zt_test_` (sandbox). Get your key at https://developers.zebratruth.ai ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.