POST /v1/webhook-endpoints/{endpointId}/rotate-secret
curl --request POST \
--url https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret \
--header 'Authorization: Bearer <token>' \
--header 'Idempotency-Key: <idempotency-key>'import requests
url = "https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret"
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', Authorization: 'Bearer <token>'}
};
fetch('https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"signing_secret": "<string>",
"overlap_hours": 24
}Endpoints
Rotate the Signing Secret
Issue a new signing secret, keeping the old one valid for 24 hours.
POST
/
v1
/
webhook-endpoints
/
{endpointId}
/
rotate-secret
POST /v1/webhook-endpoints/{endpointId}/rotate-secret
curl --request POST \
--url https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret \
--header 'Authorization: Bearer <token>' \
--header 'Idempotency-Key: <idempotency-key>'import requests
url = "https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret"
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', Authorization: 'Bearer <token>'}
};
fetch('https://sandbox.api.prava.space/v1/webhook-endpoints/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"signing_secret": "<string>",
"overlap_hours": 24
}Returns a new one-time
signing_secret and overlap_hours: 24. The previous secret stays valid for 24 hours, so accept both while you update your receiver. See Security.
This request requires an Idempotency-Key header and has no body, so omit Content-Type: application/json. A retry with the same key returns { "replayed": true, "overlap_hours": 24 } without the secret.
You can’t rotate again during the overlap: the request returns 409 WEBHOOK_ROTATION_OVERLAP.Authorizations
Your secret key: sk_test_* (sandbox) or sk_live_* (production).
Headers
Pattern:
^[A-Za-z0-9_-]{8,120}$