Saltar al contenido principal
POST
Rotate a Webhook Signing Secret

Autorizaciones

Authorization
string
header
requerido

JWT Bearer token authentication. The tenantId is derived from the bearer token or authenticated request context and is not supplied through X-Organization-Id.

Encabezados

X-Idempotency
string
requerido

Required idempotency key for safe retries. Use a UUID v4 or a unique business identifier, made of letters, digits, ., _, and -. If the same key is sent again and the original request was already processed, the cached response is returned.

See Retries and idempotency for details.

Maximum string length: 255
Pattern: ^[a-zA-Z0-9._-]+$

Parámetros de ruta

webhookId
string<uuid>
requerido

The unique identifier of the webhook registration whose secret will be rotated.

Respuesta

Indicates that a new signing secret was generated. The signingSecret is returned only in this response.

Repeated calls with the same X-Idempotency key replay the cached response.

See Retries and idempotency for more details.

id
string<uuid>
requerido

The unique identifier of the webhook registration.

Ejemplo:

"550e8400-e29b-41d4-a716-446655440000"

name
string
requerido

The human-readable name of the registration.

Ejemplo:

"Operations webhook"

endpointUrl
string<uri>
requerido

The HTTPS endpoint that receives event deliveries.

Ejemplo:

"https://hooks.example.com/transfer-events"

enabled
boolean
requerido

Whether the registration is active.

Ejemplo:

true

createdAt
string<date-time>
requerido

The timestamp when the registration was created.

Ejemplo:

"2026-02-01T15:30:00Z"

updatedAt
string<date-time>
requerido

The timestamp of the last update.

Ejemplo:

"2026-02-01T15:30:00Z"

signingSecret
string
requerido

The newly generated signing secret, returned only in this response. The previous secret stops being valid.

Ejemplo:

"whsec_example_rotated_not_a_real_secret"

eventTypes
string[]

The event types this endpoint subscribes to. Absent when the registration receives every event type.

Ejemplo: