Rotate a Trigger subscription's token

POST /v1/trigger-subscriptions/{subscription_id}/rotate-token

Property	Value
Operation	`rotate_trigger_subscription_token`
Group	Triggers
Scope	`integrations:write`
Route class	`control`
Idempotency	`Idempotency-Key` accepted: a retry with the same key replays the first answer
Audit	Audited `integrations.trigger_subscription.rotate_token` (mutation)
Released in	1.61.0
Phase 0 host	Served (the hosted api pins 1.65.0)

Issues a new token for the edge path and answers the subscription with it, once, at the revision If-Match names (1.61.0; integrations-operations.md section 3). The previous token keeps verifying until previous_token_expires_at, 24 hours later (a target), so the vendor's webhook can be moved without losing an event; the de-duplication key does not change, because the run-log key keys it. Writes an Audit event naming the subscription, never a token.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the integrations:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X POST "$VOCAL_API/v1/trigger-subscriptions/trs_.../rotate-token" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H 'If-Match: "1"' \
  -H "Idempotency-Key: $(uuidgen)"

const response = await fetch(`${process.env.VOCAL_API}/v1/trigger-subscriptions/trs_.../rotate-token`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
    'If-Match': '"1"',
    'Idempotency-Key': crypto.randomUUID(),
  },
});
console.log(response.status, await response.text());

import os
import uuid

import requests

response = requests.post(
    f"{os.environ['VOCAL_API']}/v1/trigger-subscriptions/trs_.../rotate-token",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
        "If-Match": '"1"',
        "Idempotency-Key": str(uuid.uuid4()),
    },
)
print(response.status_code, response.text)

Parameters

Name	In	Type	Required	Description
`subscription_id`	path	TriggerSubscriptionId	yes	The id of a Trigger subscription: `trs_` and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log.
`if-match`	header	string	yes	The revision the change was made against, quoted as the ETag returns it, or `*` to overwrite.
`idempotency-key`	header	string	no	A client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response.

Responses

Status	Content type	Shape	Error codes
`200`	`application/json`	TriggerSubscription
`400`	`application/json`	ErrorEnvelope	`invalid_request`
`401`	`application/json`	ErrorEnvelope	`unauthenticated`
`403`	`application/json`	ErrorEnvelope	`forbidden`, `org_suspended`
`404`	`application/json`	ErrorEnvelope	`not_found`
`409`	`application/json`	ErrorEnvelope	`connection_revoked`, `idempotency_in_progress`, `idempotency_key_reused`
`412`	`application/json`	ErrorEnvelope	`revision_mismatch`
`428`	`application/json`	ErrorEnvelope	`precondition_required`
`429`	`application/json`	ErrorEnvelope	`rate_limited`
`500`	`application/json`	ErrorEnvelope	`internal_error`

Fields of the `200` answer

The shape is TriggerSubscription.

Field	Type	Required	Description
`action`	TriggerAction	yes
`connection_id`	ConnectionId	yes
`connector_id`	ConnectorId	yes
`created_at`	Timestamp	yes
`enabled`	boolean	yes
`event_type`	TriggerEventTypeName	yes
`filter`	ZenExpression or null	yes	A ZEN expression over the event's typed fields; null acts on every event.
`id`	TriggerSubscriptionId	yes
`name`	string	yes
`object`	`"trigger_subscription"`	yes
`organization_id`	OrganizationId	yes
`previous_token_expires_at`	Timestamp or null	no	After a token rotation (1.61.0), when the previous token stops verifying, 24 hours later (a target); null otherwise, absent from an api before 1.61.0.
`rate_limit_per_minute`	integer	yes
`revision`	integer	yes
`status`	TriggerSubscriptionStatus	yes
`subscription_token`	string (password) or null (password)	yes	The token of the edge path `/v1/triggers/{connector_id}/{subscription_token}`, 32 random bytes in base64url: answered once by the create, null in every other answer.
`token_hint`	string	yes	The last characters of the subscription token.
`updated_at`	Timestamp	yes

Rotate a Trigger subscription's token

Request

Parameters

Responses

Fields of the 200 answer

Fields of the `200` answer