FIfirma
Webhooks

Rotate workspace webhook secret

Generates a new webhook signing secret for the workspace. For 7 days after the rotation, Firma also signs the workspace's deliveries with the previous secret in X-Firma-Signature-Old. Only one previous secret is kept: rotating again within the 7 days replaces it. A secret can be rotated once per hour; a second call within the hour returns 429 with code COOLDOWN_ACTIVE.

post/workspaces/{id}/webhooks/rotate-secret

Request

Path parameters

idstring uuid required

Workspace ID

Response

Secret rotated successfully

messagestring required
new_secretstring required

The new webhook signing secret (64 character hex string)

grace_period_hoursinteger required

Hours the old secret remains valid alongside the new one

warningstring

Reminder to update webhook signature verification

Changes

No recorded changes to this operation across all 13 revisions of this API.