Rotate a webhook signing secret

POST

/webhooks/{id}/rotate-secret

• Production
• Test (use test keys with the same host; sandbox semantics apply)

Generates a new HMAC-SHA256 signing secret for the endpoint. Old signatures are no longer valid after rotation.

Authorizations

• bearerAuth
• xApiKey

Parameters

Header Parameters

Idempotency-Key

string

<= 255 characters

Unique identifier used to replay requests safely.

Responses

200

Webhook endpoint with the new secret.

Media typeapplication/json

object

object

string

Allowed values: list

data

array

has_more

boolean

Example

{
  "object": "list"
}

404

Error response.

Media typeapplication/json

object

error

required

string

message

string

code

string

details

object

Example ^generated

{
  "error": "example",
  "message": "example",
  "code": "example",
  "details": {}
}

429

Too many requests.

Media typeapplication/json

object

error

required

string

message

string

code

string

details

object

Example ^generated

{
  "error": "example",
  "message": "example",
  "code": "example",
  "details": {}
}

Headers

RateLimit-Limit

integer

Maximum requests per window.

RateLimit-Remaining

integer

Requests remaining in the current window.

RateLimit-Reset

integer

Unix seconds when the window resets.

Retry-After

integer

Seconds to wait before retrying (on 429/handled outages).