Rotate a Webhook subscription's secret

POST /v1/webhooks/{webhook_id}/rotate-secret

Mints a new secret and answers it once (1.63.0, FR-webhooks-5). The previous secret keeps signing for previous_secret_expires_in_s, 86,400 by default and at most 604,800 (targets), and every delivery of that window carries two v1 values, the new one first; a rotation inside the window retires the oldest secret. From 1.64.0, stated as the api built it: a request repeated under the same Idempotency-Key by the same credential answers the stored answer with the secret again while it is still the subscription's current secret, and writes the Audit event webhooks.subscription.secret_read; once the subscription is deleted the repeat is not_found, and once the secret is rotated it is 409 idempotency_key_reused, the secret never shown again.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the webhooks:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X POST "$VOCAL_API/v1/webhooks/whk_.../rotate-secret" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

const response = await fetch(`${process.env.VOCAL_API}/v1/webhooks/whk_.../rotate-secret`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
});
console.log(response.status, await response.text());

import os
import uuid

import requests

response = requests.post(
    f"{os.environ['VOCAL_API']}/v1/webhooks/whk_.../rotate-secret",
    headers={
        "Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={},
)
print(response.status_code, response.text)

Parameters

Request body

Content type application/json, required: WebhookSecretRotationRequest.

Responses

Fields of the 200 answer

The shape is WebhookSecretRotation.