diff --git a/lib/denylist/http.go b/lib/denylist/http.go
index bbae2312..43d2b510 100644
--- a/lib/denylist/http.go
+++ b/lib/denylist/http.go
@@ -1,7 +1,9 @@
 package denylist
 
 import (
+	"encoding/json"
 	"net/http"
+	"strings"
 )
 
 // CollectionEndpoint serves the endpoints for the whole Denylist at /denylist
@@ -42,6 +44,21 @@ func createDenylistEntry(response http.ResponseWriter, request *http.Request, de
 
 // GET /denylist/...
 func getDenylistEntry(response http.ResponseWriter, request *http.Request, denylist *Denylist) {
+	id := request.URL.Path
+	entry := denylist.GetEntry(id)
+	if entry == nil {
+		http.Error(response, "denylist entry not found with that id", http.StatusNotFound)
+		return
+	}
+
+	payload := map[string]string{
+		"keys":  strings.Join(entry.Keys, KeysSeparator),
+		"regex": entry.Regex.String(),
+	}
+
+	response.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(response).Encode(payload)
+	response.WriteHeader(http.StatusOK)
 }
 
 // DELETE /denylist/...