Skip to main content
Glama

Get the webhook of a form

get_webhook
Read-only

Call this to check where the webhook of a form posts and whether deliveries succeed; it shows only a masked secret, so call reveal_webhook_secret when the receiving server needs the full one, and update_form_settings to set or remove the URL. Returns url, the masked secret and the last 100 deliveries with submission_id, attempt, status_code, error, duration_ms and created_at. Requires an account key (fh_live_...); agent keys answer owner_key_required.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
form_idYesThe 10-character form_id returned by publish_form or list_forms, such as "abcDEF1234".
reveal_secretNoRetired. Call reveal_webhook_secret for the full signing secret.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes
secretYes
deliveriesYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / form_id / description
      Previous value: -"The form_id returned by publish_form or list_forms."New value: +"The 10-character form_id returned by publish_form or list_forms, such as \"abcDEF1234\"."
  2. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover the safety profile (readOnlyHint=true, idempotentHint=false). The description adds substantial context beyond them: the secret is masked, deliveries are capped at the last 100, and an account key is required with the literal error string returned otherwise. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then alternatives, then return fields, then auth requirement – a sensible order with no filler. It is slightly over-packed into one long semicolon chain, and enumerating return fields is mildly redundant given an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, sibling routing, auth requirements, failure behavior, and the shape of the result. Even though an output schema exists, nothing an agent needs to select or invoke this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (form_id and the retired reveal_secret) are already documented, and the schema itself says reveal_secret is retired. The description reinforces the redirect to reveal_webhook_secret but adds no format or syntax detail beyond the schema, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (check where a form's webhook posts and whether deliveries succeed) and explicitly separates itself from reveal_webhook_secret and update_form_settings. An agent can distinguish this from every sibling without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit routing rules: call this to inspect, call reveal_webhook_secret when the receiving server needs the full secret, call update_form_settings to set or remove the URL. It also states the prerequisite (account key fh_live_...) and names the exact failure mode for agent keys (owner_key_required).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources