Skip to main content
POST
Rotate a Webhook Signing Secret

Autorizaciones

Authorization
string
header
requerido

JWT Bearer token authentication. The tenantId is derived from the bearer token or authenticated request context and is not supplied through X-Organization-Id.

Encabezados

X-Idempotency
string
requerido

Required idempotency key for safe retries. Use a UUID v4 or unique business identifier. If the same key is sent again and the original request was already processed, the cached response is returned.

See Retries and idempotency for details.

Maximum string length: 255

Parámetros de ruta

webhookId
string<uuid>
requerido

The unique identifier of the webhook registration whose secret will be rotated.

Respuesta

Indicates that a new signing secret was generated. The signingSecret is returned only in this response.

Repeated calls with the same X-Idempotency key replay the cached response.

See Retries and idempotency for more details.

id
string<uuid>
requerido

The unique identifier of the webhook registration.

Ejemplo:

"550e8400-e29b-41d4-a716-446655440000"

name
string
requerido

The human-readable name of the registration.

Ejemplo:

"Operations webhook"

endpointUrl
string<uri>
requerido

The HTTPS endpoint that receives event deliveries.

Ejemplo:

"https://hooks.example.com/transfer-events"

enabled
boolean
requerido

Whether the registration is active.

Ejemplo:

true

createdAt
string<date-time>
requerido

The timestamp when the registration was created.

Ejemplo:

"2026-02-01T15:30:00Z"

updatedAt
string<date-time>
requerido

The timestamp of the last update.

Ejemplo:

"2026-02-01T15:30:00Z"

signingSecret
string
requerido

The newly generated signing secret, returned only in this response. The previous secret stops being valid.

Ejemplo:

"whsec_example_rotated_not_a_real_secret"

eventTypes
string[]

The event types this endpoint subscribes to. Absent when the registration receives every event type.

Ejemplo: