Skip to content

Rotate the signing secret

Adds a new secret version; both sign during the overlap (1–168 h, default 24 h). The new secret is shown once.

POST
/v1/webhook-endpoints/{endpointId}/rotate-secret

Adds a new secret version; both sign during the overlap (1–168 h, default 24 h). The new secret is shown once.

Authorization

AuthorizationBearer <token>

OAuth 2.0 client credentials. private_key_jwt (SMART Backend Services asymmetric) is recommended; client secrets need an IP allowlist or mTLS outside the sandbox.

In: header

Scope: webhooks:write

Path Parameters

endpointId*string

An opaque we_ id.

Match^we_[0-9A-Za-z]{16,64}$

Header Parameters

Api-Version?enum

Overrides the app's pinned dated version for this request.

Idempotency-Key?string

1–255 characters of [A-Za-z0-9._:-] (a UUID v4 is recommended); never PHI. Stored 24 hours per app.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/webhook-endpoints/we_k57a1x2m9q4t8v3w5x1y6z7a8b9c0d1e/rotate-secret" \  -H "Content-Type: application/json" \  -d '{}'
{  "object": "webhook_secret",  "previousExpiresAt": "2026-09-14T15:00:11.402Z",  "secret": "string",  "version": -9007199254740991}

Was this page helpful?