Skip to main content
POST
/
v1
/
webhooks
/
{webhookId}
/
signing-secret
/
rotate
Rotate a Webhook Signing Secret
curl --request POST \
  --url https://plugin-br-bank-transfer.sandbox.lerian.net/v1/webhooks/{webhookId}/signing-secret/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'X-Idempotency: <x-idempotency>'
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Operations webhook",
  "endpointUrl": "https://hooks.example.com/transfer-events",
  "enabled": true,
  "eventTypes": [
    "transfer.completed"
  ],
  "signingSecret": "whsec_example_rotated_not_a_real_secret",
  "createdAt": "2026-02-01T15:30:00Z",
  "updatedAt": "2026-02-01T16:30:00Z"
}

Authorizations

​
Authorization
string
header
required

JWT Bearer token authentication. The tenantId is derived from the bearer token or authenticated request context and is not supplied through X-Organization-Id.

Headers

​
X-Idempotency
string
required

Required idempotency key for safe retries. Use a UUID v4 or unique business identifier. If the same key is sent again and the original request was already processed, the cached response is returned.

See Retries and idempotency for details.

Maximum string length: 255

Path Parameters

​
webhookId
string<uuid>
required

The unique identifier of the webhook registration whose secret will be rotated.

Response

Indicates that a new signing secret was generated. The signingSecret is returned only in this response.

Repeated calls with the same X-Idempotency key replay the cached response.

See Retries and idempotency for more details.

​
id
string<uuid>
required

The unique identifier of the webhook registration.

Example:

"550e8400-e29b-41d4-a716-446655440000"

​
name
string
required

The human-readable name of the registration.

Example:

"Operations webhook"

​
endpointUrl
string<uri>
required

The HTTPS endpoint that receives event deliveries.

Example:

"https://hooks.example.com/transfer-events"

​
enabled
boolean
required

Whether the registration is active.

Example:

true

​
createdAt
string<date-time>
required

The timestamp when the registration was created.

Example:

"2026-02-01T15:30:00Z"

​
updatedAt
string<date-time>
required

The timestamp of the last update.

Example:

"2026-02-01T15:30:00Z"

​
signingSecret
string
required

The newly generated signing secret, returned only in this response. The previous secret stops being valid.

Example:

"whsec_example_rotated_not_a_real_secret"

​
eventTypes
string[]

The event types this endpoint subscribes to. Absent when the registration receives every event type.

Example:
["transfer.completed"]