Rotate the signing secret

POST 
/webhook_endpoints/:external_id/rotate_secret

Returns a new signing secret (shown once). The previous secret keeps signing for a 24h overlap window, so deliveries carry a v1 for both; verify against either. Returns 403 manage_endpoints_on_live_api on the sandbox API; use the live API.

Request

Responses

200

Rotated (includes the new one-time secret)

401

Authentication required or token is invalid/expired. This error occurs when:

• No Authorization header is provided
• The access token is invalid or malformed
• The access token has expired
• The access token has been revoked

To resolve: Obtain a new access token using the OAuth 2.0 flow.

403

The authenticated user does not have permission to access this resource. This typically means:

• The user is authenticated but lacks the required OAuth scope
• The resource belongs to a different user
• The user's role doesn't allow this operation

Check that your OAuth token includes the necessary scopes for this endpoint.

404

The requested resource does not exist or is not visible to this token.