Webhooks

Rotate a webhook's signing secret

MepMail extension. Mints a new signing secret (or takes the one in signing_secret) and returns it. For overlap_hours the previous secret keeps signing too: every delivery in that window carries both signatures, space-separated in webhook-signature, so the receiver can switch at any point without a gap. A second rotation inside the window replaces the previous secret.

post/webhooks/{id}/rotate

Request

  • Base URL: https://api.mepmail.dev
  • URL: https://api.mepmail.dev/webhooks/{id}/rotate
  • Auth: HTTP bearer

Path parameters

idstring uuid required

Request body

signing_secretstring

New secret to sign with: whsec_ followed by base64 of 24-64 bytes. Omit to mint one.

overlap_hoursinteger

Hours the previous secret keeps signing alongside the new one (default 24, max 72). Every delivery in the window carries both signatures, so a receiver holding either verifies; 0 drops the old secret at once.

Response

The new secret and when the previous one stops signing

object'webhook' required
idstring uuid required
signing_secretstring required
previous_secret_expires_atstring nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.