Rotate a webhook endpoint's signing secret
Issues a new signing secret. Deliveries carry signatures from both the new and the previous secret for 24 hours, so you can switch without missing events. Every rotation is recorded, and an idempotent replay returns the endpoint without the secret.
Authorizations
Use Authorization: Bearer end_sk_* for partner API keys (e.g. end_sk_AbCd_example_api_key).
Headers
Unique key that makes this request safe to retry. Replaying the key with the same body returns the original response with Idempotent-Replayed: true; replaying it with a different body returns 409 idempotency.key_conflict.
1 - 255"a1b2c3d4-0000-4000-8000-000000000000"
Path Parameters
"8e1a7f50-90ab-4cde-8012-3456789abcde"
Response
The endpoint with its new signing secret.
"8e1a7f50-90ab-4cde-8012-3456789abcde"
HTTPS URL that receives deliveries.
"https://hooks.example.com/endstate"
Event types this endpoint is subscribed to.
disabled on the first failed delivery after fail_since is five days old, after a 410 response, or when deleted. Re-enable with PATCH.
enabled, disabled "enabled"
When the current run of failed deliveries began, or null while deliveries succeed. The next failed delivery after this is five days old disables the endpoint, so fix the receiver before then.
null
Dated payload version this endpoint receives.
"2026-09-01"
Signing secret for this endpoint. Present on the first response only: an idempotent replay of the same request (Idempotent-Replayed: true) omits it. An admin API key can read it again through the secret endpoint; every read is recorded.
"whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"

