FIfirma
Webhooks

Rotate webhook signing secret

Generates a new webhook signing secret for the company. For 7 days after the rotation, Firma also signs deliveries with the previous secret in X-Firma-Signature-Old. Only one previous secret is kept: rotating again within the 7 days replaces it. A secret can be rotated once per hour; a second call within the hour returns 429 with code COOLDOWN_ACTIVE.

post/webhooks/rotate-secret

Request

Response

Secret rotated successfully

messagestring required
new_secretstring required

The new webhook signing secret (64 character hex string)

grace_period_hoursinteger required

Hours the old secret remains valid alongside the new one

warningstring

Reminder to update webhook signature verification

Changes

No recorded changes to this operation across all 13 revisions of this API.