`get_webhooks_health`

Read-only

Calls GET /webhooks/health as the signed-in person · REST reference

Per-receiver signature-verification posture

Root-mounted at /webhooks, not under /api, and unauthenticated like the receivers it reports on - so it reports only whether each secret is PRESENT, never any secret value. It reads process.env and nothing else, so it cannot fail and does not touch the DAL or Stripe. Each state names a CONSEQUENCE, not a configuration - verified means a signing secret is configured and every delivery is checked against it; unsigned means deliveries are ACCEPTED WITHOUT verification and are therefore forgeable; rejecting means the receiver REFUSES every delivery, the silent failure mode that stops donations from landing. The three money receivers (stripe, mercury, xeon), stripeConnect and retell all fail closed, so with no secret they read rejecting unless ALLOW_UNSIGNED_WEBHOOKS=true is honoured, which it never is on a production tier. The printer receiver skips verification entirely when PRINTER_WEBHOOK_SECRET is unset, so it reads unsigned there: the same missing secret, the opposite behaviour.

Arguments

This tool takes no arguments.

Example call

A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_webhooks_health",
    "arguments": {}
  }
}

Result

On success (HTTP 200) the tool returns one text item holding the API's JSON, pretty-printed.

Configuration posture of every receiver on this router.

json

{
  "providers": {
    "key": "verified"
  },
  "status": "OK",
  "timestamp": "2026-01-15T12:00:00Z",
  "webhooks": [
    "string"
  ]
}

Fields

Field	Type	Description
`providers`	object	Keyed by provider name (stripe, stripeConnect, mercury, xeon, printer, retell).
`status`	"OK" \| "DEGRADED"	OK only when every provider is `verified`.
`timestamp`	string (date-time)	ISO-8601, generated per request.
`webhooks`	array of string	The provider names, i.e. the keys of `providers`.

When it fails

A failed call returns isError: true with the API's message as text.

What the model is shown

This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.

json

{
  "name": "get_webhooks_health",
  "description": "GET /webhooks/health — Root-mounted at /webhooks, not under /api, and unauthenticated like the receivers it reports on - so it reports only whether each secret is PRESENT, never any secret value. It reads process.env and nothing else, so it cannot fail and does not touch the DAL or Stripe. Each state names a CONSEQUENCE, not a configuration - `verified` means a signing secret is configured and every delivery is checked against it; `unsigned` means deliveries are ACCEPTED WITHOUT verification and are therefore forgeable; `rejecting` means the receiver REFUSES every delivery, the silent failure mode that stops donations from landing. The three money receivers (stripe, mercury, xeon), stripeConnect and retell all fail closed, so with no secret they read `rejecting` unless ALLOW_UNSIGNED_WEBHOOKS=true is honoured, which it never is on a production tier. The printer receiver skips verification entirely when PRINTER_WEBHOOK_SECRET is unset, so it reads `unsigned` there: the same missing secret, the opposite behaviour.",
  "inputSchema": {
    "type": "object",
    "properties": {}
  },
  "annotations": {
    "readOnlyHint": true,
    "openWorldHint": false
  }
}