Skip to main content
POST
POST /v1/webhook-endpoints/{endpointId}/rotate-secret
Returns a new one-time signing_secret and overlap_hours: 24. The previous secret stays valid for 24 hours, so accept both while you update your receiver. See Security. This request requires an Idempotency-Key header and has no body, so omit Content-Type: application/json. A retry with the same key returns { "replayed": true, "overlap_hours": 24 } without the secret. You can’t rotate again during the overlap: the request returns 409 WEBHOOK_ROTATION_OVERLAP.

Authorizations

Authorization
string
header
required

Your secret key: sk_test_* (sandbox) or sk_live_* (production).

Headers

Idempotency-Key
string
required
Pattern: ^[A-Za-z0-9_-]{8,120}$

Path Parameters

endpointId
string
required

Response

Successful operation; endpoints never include stored signing secrets.

signing_secret
string
required

The new secret. Returned only on this response.

overlap_hours
integer
required

Hours the previous secret stays valid.