Webhook Endpoints

Rotate a webhook endpoint's secret

curl -X POST https://api.subscriby.net/v1/webhook-endpoints/$ENDPOINT_ID/rotate-secret \
  -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)"

Answers 200 with the endpoint and a brand-new secret alongside data. The old secret is revoked immediately: deploy the new one to your handler before calling this endpoint.

post/v1/webhook-endpoints/{endpoint}/rotate-secret

Request

  • Base URL: https://api.subscriby.net
  • URL: https://api.subscriby.net/v1/webhook-endpoints/{endpoint}/rotate-secret
  • Auth: HTTP bearer

Path parameters

endpointstring uuid required

The endpoint, resolved by the route binder.

Headers

Idempotency-Keystring uuid required

A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.

Response

The resource with the new plaintext secret, once.

secretstring required

The new plaintext signing secret, whsec_…, returned once.

Example response

{
  "data": {
    "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9",
    "name": "Zapier trigger",
    "url": "https://hooks.zapier.com/hooks/catch/...",
    "events": [
      "subscription.created"
    ],
    "is_active": true,
    "created_at": "2026-05-18T10:05:00Z",
    "updated_at": "2026-05-18T10:05:00Z"
  }
}

Changes

No recorded changes to this operation across all 2 revisions of this API.