Rotate the signing secret
Adds a new secret version; both sign during the overlap (1–168 h, default 24 h). The new secret is shown once.
Adds a new secret version; both sign during the overlap (1–168 h, default 24 h). The new secret is shown once.
OAuth 2.0 client credentials. private_key_jwt (SMART Backend Services asymmetric) is recommended; client secrets need an IP allowlist or mTLS outside the sandbox.
In: header
Scope: webhooks:write
Path Parameters
An opaque we_ id.
^we_[0-9A-Za-z]{16,64}$Header Parameters
Overrides the app's pinned dated version for this request.
1–255 characters of [A-Za-z0-9._:-] (a UUID v4 is recommended); never PHI. Stored 24 hours per app.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/webhook-endpoints/we_k57a1x2m9q4t8v3w5x1y6z7a8b9c0d1e/rotate-secret" \ -H "Content-Type: application/json" \ -d '{}'{ "object": "webhook_secret", "previousExpiresAt": "2026-09-14T15:00:11.402Z", "secret": "string", "version": -9007199254740991}