POST/api/v1/webhooks/{id}/secret/rotate

Rotate webhook secret

Generates a new 32-byte base64url signing secret, persists it via webhookModel.update, and returns the secret in the response. The secret is only available at rotation time.

RBAC · webhook

Path parameters

idstring <uuid>Required

Webhook UUID from webhooks.webhook_id.

Response body

Success response 200 · schema WebhookSecretRotationEnvelopeV1

dataobjectRequired

webhook_idstring <uuid>Required

signing_secretstringRequired

32-byte base64url secret; only returned at rotation time.

metaobject

Response codes

200

Secret rotated.

400

Invalid request payload, query, or webhook id format.

401

API key missing/invalid or key user missing.

403

Webhook RBAC permission denied.

404

Webhook, delivery, template, or signing secret not found.

500

Unexpected webhook operation failure.

POST /api/v1/webhooks/{id}/secret/rotate

cURL

curl -X POST "https://algapsa.com/api/v1/webhooks/{id}/secret/rotate" \
  -H "X-API-Key: $ALGA_API_KEY"

TypeScript

const response = await fetch("https://algapsa.com/api/v1/webhooks/{id}/secret/rotate", {
  method: "POST",
  headers: {
    "X-API-Key": "$ALGA_API_KEY",
  }
});
const data = await response.json();

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://algapsa.com/api/v1/webhooks/{id}/secret/rotate");
request.Headers.TryAddWithoutValidation("X-API-Key", "$ALGA_API_KEY");
var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

200 OK·application/json

{
  "data": {
    "webhook_id": "01HN2K7VRB9PQ3Y0000000000",
    "signing_secret": "string"
  },
  "meta": {}
}