Rotate the signing secret

POST 
/v1/webhooks/:id/regenerate-secret

Replaces the signing secret and returns the new value once. By default the previous secret keeps signing deliveries for 24 hours (previous_secret_grace_hours), during which every delivery carries one signature per secret so the receiver can switch keys without dropping events. Pass 0 to revoke the previous secret immediately (leaked secret). Accepts either the internal UUID or the resource external_id.

Request

Responses

200

New signing secret (shown once).

401

Authentication failed (missing/invalid JWT or mTLS).

403

Authenticated but the scope is insufficient or the resource is out of reach.

404

Resource not found or filtered out by soft-delete.