Skip to main content
POST
Rotate a Webhook Signing Secret

Autorizações

Authorization
string
header
obrigatório

JWT Bearer token authentication. The tenantId is derived from the bearer token or authenticated request context and is not supplied through X-Organization-Id.

Cabeçalhos

X-Idempotency
string
obrigatório

Required idempotency key for safe retries. Use a UUID v4 or unique business identifier. If the same key is sent again and the original request was already processed, the cached response is returned.

See Retries and idempotency for details.

Maximum string length: 255

Parâmetros de caminho

webhookId
string<uuid>
obrigatório

The unique identifier of the webhook registration whose secret will be rotated.

Resposta

Indicates that a new signing secret was generated. The signingSecret is returned only in this response.

Repeated calls with the same X-Idempotency key replay the cached response.

See Retries and idempotency for more details.

id
string<uuid>
obrigatório

The unique identifier of the webhook registration.

Exemplo:

"550e8400-e29b-41d4-a716-446655440000"

name
string
obrigatório

The human-readable name of the registration.

Exemplo:

"Operations webhook"

endpointUrl
string<uri>
obrigatório

The HTTPS endpoint that receives event deliveries.

Exemplo:

"https://hooks.example.com/transfer-events"

enabled
boolean
obrigatório

Whether the registration is active.

Exemplo:

true

createdAt
string<date-time>
obrigatório

The timestamp when the registration was created.

Exemplo:

"2026-02-01T15:30:00Z"

updatedAt
string<date-time>
obrigatório

The timestamp of the last update.

Exemplo:

"2026-02-01T15:30:00Z"

signingSecret
string
obrigatório

The newly generated signing secret, returned only in this response. The previous secret stops being valid.

Exemplo:

"whsec_example_rotated_not_a_real_secret"

eventTypes
string[]

The event types this endpoint subscribes to. Absent when the registration receives every event type.

Exemplo: