Markdown to PDF
5 PDFs free

API documentation

Rotate a webhook signing secret

Webhooks

Rotate a webhook signing secret

Rotate the signing secret without invalidating deliveries already created under the preceding version.

POST/api/v2/webhooks/{webhookId}/rotate-secret
Required scopewebhooks.write

Parameters

webhookId
pathstring<uuid>required

Owner-scoped outbound webhook subscription identifier.

Idempotency-Key
headerstringrequired

Required for replay-safe mutations. Use a unique opaque value for one logical operation and reuse it only with an identical request.

  • Minimum length: 8
  • Maximum length: 200
  • Pattern: ^[^\x00-\x1F\x7F]+$

Request body

This operation does not accept a request body.

Operational behavior

Idempotency

Idempotency-Key is required. Mode: key required.

Retries

Reuse the same Idempotency-Key. A replay returns the original rotated secret and never creates another version. Retry statuses: 429, 503. Honor Retry-After.

Retention

Retired encrypted secrets remain only for deliveries already pinned to them. The new plaintext secret is returned by the idempotent rotation response. Response field: secret.createdAt.

Responses

201The newly active signing secret and subscription identifier.

Response headers

X-Correlation-IdIdempotency-Replayed

Response schema

WebhookRotationResponse

Webhook Rotation Response object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

secret
objectrequired

Secret value.

subscriptionId
string<uuid>required

Subscription Id value.

201 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "secret": {
    "createdAt": "2026-07-20T15:10:00.000Z",
    "fingerprint": "9a7c1e204f63d8b2",
    "signingSecret": "whsec_rotatedSigningSecretForDocumentation_1234567",
    "version": 2
  },
  "subscriptionId": "55555555-5555-4555-8555-555555555555"
}
401The bearer credential is missing, malformed, expired, revoked, or belongs to the wrong environment.

Response headers

X-Correlation-Id

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

401 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "authentication",
    "code": "unauthorized",
    "httpStatus": 401,
    "message": "A valid API key is required.",
    "retryable": false
  }
}
403The principal is authenticated but lacks the operation's required scope.

Response headers

X-Correlation-Id

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

403 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "authorization",
    "code": "forbidden",
    "httpStatus": 403,
    "message": "The API key does not have the required scope.",
    "retryable": false
  }
}
404The resource does not exist or is not visible to this principal. Cross-tenant misses use the same response.

Response headers

X-Correlation-Id

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

404 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "authorization",
    "code": "not_found",
    "httpStatus": 404,
    "message": "The requested resource was not found.",
    "retryable": false
  }
}
409The resource state conflicts with the request, including idempotency-key reuse with a different canonical request hash.

Response headers

X-Correlation-Id

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

409 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "conflict",
    "code": "idempotency_conflict",
    "httpStatus": 409,
    "message": "This idempotency key was already used with a different request.",
    "retryable": false
  }
}
429The request is temporarily rate limited. No final publication unit is consumed.

Response headers

X-Correlation-IdRetry-After

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

429 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "entitlement",
    "code": "rate_limited",
    "details": {
      "retryAfterSeconds": 30
    },
    "httpStatus": 429,
    "message": "Too many publishing requests. Retry after 30 seconds.",
    "retryable": true
  }
}
503A transient publishing, queue, renderer, or storage dependency is unavailable. No failed render consumes a final publication unit.

Response headers

X-Correlation-IdRetry-After

Response schema

PublishingErrorEnvelope

Publishing Error Envelope object used by the Publishing API.

contractVersion
stringrequired

Contract Version value.

error
objectrequired

Error value.

503 example
{
  "contractVersion": "publishing.lifecycle.v1",
  "error": {
    "category": "internal",
    "code": "service_unavailable",
    "details": {
      "retryAfterSeconds": 30
    },
    "httpStatus": 503,
    "message": "Publishing is temporarily unavailable.",
    "retryable": true
  }
}

Checking API access

Loading your activation state.