Skip to main content
POST
Rotate a webhook endpoint's signing secret

Authorizations

Authorization
string
header
required

Use Authorization: Bearer end_sk_* for partner API keys (e.g. end_sk_AbCd_example_api_key).

Headers

Idempotency-Key
string

Unique key that makes this request safe to retry. Replaying the key with the same body returns the original response with Idempotent-Replayed: true; replaying it with a different body returns 409 idempotency.key_conflict.

Required string length: 1 - 255
Example:

"a1b2c3d4-0000-4000-8000-000000000000"

Path Parameters

endpoint_id
string<uuid>
required
Example:

"8e1a7f50-90ab-4cde-8012-3456789abcde"

Response

The endpoint with its new signing secret.

id
string<uuid>
required
Example:

"8e1a7f50-90ab-4cde-8012-3456789abcde"

url
string<uri>
required

HTTPS URL that receives deliveries.

Example:

"https://hooks.example.com/endstate"

event_types
string[]
required

Event types this endpoint is subscribed to.

Example:
description
string | null
required
status
enum<string>
required

disabled on the first failed delivery after fail_since is five days old, after a 410 response, or when deleted. Re-enable with PATCH.

Available options:
enabled,
disabled
Example:

"enabled"

disabled_reason
string | null
required
fail_since
string<date-time> | null
required

When the current run of failed deliveries began, or null while deliveries succeed. The next failed delivery after this is five days old disables the endpoint, so fix the receiver before then.

Example:

null

api_version
string
required

Dated payload version this endpoint receives.

Example:

"2026-09-01"

created_at
string<date-time>
required
updated_at
string<date-time>
required
secret
string

Signing secret for this endpoint. Present on the first response only: an idempotent replay of the same request (Idempotent-Replayed: true) omits it. An admin API key can read it again through the secret endpoint; every read is recorded.

Example:

"whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"