Rotate the signing secret

POST/webhooks/{id}/rotate-secretNeedsworkspace.settings

Returns a new secret (shown once). For 24 hours requests also carry a signature made with the old one, so you can switch without failed verifications — unless expirePrevious (for a leaked secret).

Authorization

secretKey

headerAuthorizationBearer <sk_…>

A secret API key from Settings → API keys. It acts with its creator's role.

Path Parameters

id*integer

The endpoint's id.

Range1 <= value

Request Body

application/json

body

expirePrevious?boolean

Defaultfalse

Response Body

application/json

response

webhook*

secret*string

The new secret.

Shell

curl -X POST 'https://app.cueston.com/api/webhooks/1/rotate-secret' \
  -H 'Content-Type: application/json' \
  -d '{}'curl -X POST 'https://app.cueston.com/api/webhooks/1/rotate-secret' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example ResponseSchema

JSON

{
  "webhook": {
    "id": 42,
    "url": "https://app.acme.com/settings/billing",
    "description": "string",
    "events": [
      "string"
    ],
    "active": true,
    "disabledReason": "string",
    "disabledAt": "2026-10-26T09:30:00Z",
    "failingSince": "2026-10-26T09:30:00Z",
    "lastSuccessAt": "2026-10-26T09:30:00Z",
    "lastFailureAt": "2026-10-26T09:30:00Z",
    "secretHint": "whsec_9vY2…",
    "previousSecretExpiresAt": "2026-10-26T09:30:00Z",
    "createdAt": "2026-10-26T09:30:00Z",
    "updatedAt": "2026-10-26T09:30:00Z"
  },
  "secret": "whsec_9vY2kQ…"
}{
  "webhook": {
    "id": 42,
    "url": "https://app.acme.com/settings/billing",
    "description": "string",
    "events": [
      "string"
    ],
    "active": true,
    "disabledReason": "string",
    "disabledAt": "2026-10-26T09:30:00Z",
    "failingSince": "2026-10-26T09:30:00Z",
    "lastSuccessAt": "2026-10-26T09:30:00Z",
    "lastFailureAt": "2026-10-26T09:30:00Z",
    "secretHint": "whsec_9vY2…",
    "previousSecretExpiresAt": "2026-10-26T09:30:00Z",
    "createdAt": "2026-10-26T09:30:00Z",
    "updatedAt": "2026-10-26T09:30:00Z"
  },
  "secret": "whsec_9vY2kQ…"
}