Rotate a webhook endpoint's secret

POST/v1/webhook-endpoints/{endpointId}/rotate-secret

Issues a new signing secret, returned ONCE. For the next 24 hours deliveries carry two signatures — the new secret's and the old one's — so the receiver can switch without dropping an event.

Permissions: any valid key · Kind: write · Cost: 2 units

Cannot be undone.

Path parameters

Field	Type	Required	Description
`endpointId`	uuid	yes

Body

None.

Response `200`

Field	Type	Required	Description
`object`	"webhook_endpoint_secret"	yes
`endpointId`	uuid	yes
`secret`	string	yes	The new signing secret. Shown ONLY in this response.
`previousSecretExpiresAt`	string \| null	yes	Until then deliveries carry two signatures, one per secret.

Errors

Errors are problem details. Besides the refusals described above, any call like this one can return:

invalid_request — Invalid request
unauthorized — Missing or invalid API key
insufficient_scope — Missing permission
rate_limited — Rate limit reached
not_found — Not found
idempotency_key_reused — Idempotency-Key reused
request_in_progress — Request in progress

Examples

curl

curl -X POST https://api.bymundi.com/v1/webhook-endpoints/$ENDPOINT_ID/rotate-secret \ -H "Authorization: Bearer $BYMUNDI_KEY" \ -H "Content-Type: application/json" \ -H "Idempotency-Key: $(uuidgen)" \ -d '{}'

JavaScript

Python

import os, uuid, requests res = requests.post( f"https://api.bymundi.com/v1/webhook-endpoints/{endpointId}/rotate-secret", headers={"Authorization": f"Bearer {os.environ['BYMUNDI_KEY']}", "Idempotency-Key": str(uuid.uuid4())}, json={}, ) res.raise_for_status() data = res.json()

Rotate a webhook endpoint's secret

#Path parameters

#Body

#Response 200

#Errors

Path parameters

Body

Response `200`

Errors