OZozav
Webhooks

Rotate a webhook endpoint's signing secret

Generates a new signing secret and returns it once. The previous secret stops signing immediately, so update your verifier before rotating.

post/webhook-endpoints/{webhook_endpoint_id}/rotate-secret

Request

  • Base URL
    https://developers.ozav.io/v2
  • Auth
    • API key in header X-API-Key
    • or HTTP bearer

Response

The endpoint with its new secret (shown once).

idstring required

Opaque webhook endpoint identifier, prefixed ozav_wh_.

object'webhook_endpoint' required

Resource type discriminator; always the literal webhook_endpoint.

urlstring uri required

The HTTPS URL that receives the deliveries. Verify the signature on every request to it (see the Webhooks section); an unverified receiver accepts forged events.

enabled_eventsWebhookEventType[] required

The event types this endpoint is subscribed to. An event whose type is not listed here is never delivered to this endpoint, and no record of a skipped delivery is created.

status'active' | 'disabled' required

active - deliveries are attempted. disabled - nothing is delivered and nothing is queued for later; events that occur while disabled are not replayed on re-enable.

OZAV does not disable an endpoint on its own. A URL that has failed every delivery for weeks still reads active, so status alone is not a health signal - read health.

descriptionstring nullable

Free-form label you set. Never used for routing or delivery.

created_atstring date-time required

When the endpoint was registered (RFC 3339, UTC).

updated_atstring date-time required

When the endpoint was last modified (RFC 3339, UTC).

secretstring

Signing secret (ozav_whsec_...); returned only on creation and rotation.

Changes

No recorded changes to this operation across all 1 revision of this API.