OPopenmercantil
User
Webhooks

Rotate an outbound webhook signing secret

Changed on

Cancels pending deliveries signed with the old key and atomically stores the encrypted replacement response. An identical Idempotency-Key retry within 24 hours returns the same secret without rotating again.

post/api/v1/user/webhooks/{id}/rotate

Request

Path parameters

idinteger required

Headers

X-CSRF-Tokenstring required

Fresh token returned by GET /api/v1/user/me for this authenticated session.

Idempotency-Keystring required

Required for account mutations that reveal a secret. Reuse the same key only for an identical payload. The encrypted response can be replayed for 24 hours; a changed payload or an expired key returns 409.

Response

Rotated, or the exact replacement signing secret replayed for the same key

oktrue required
secret_visible_oncetrue required
idempotency_replayedboolean required
idempotency_expires_atinteger required

Unix timestamp for the encrypted replay window.

Changes