Webhook Connections
tier:standard

Rotate a webhook connection's signing secret

Generates a new signing secret for the connection and returns it once. The previous secret stops validating immediately, so update the receiver before rotating in production. Send an Idempotency-Key to retry safely: a retry under the same key returns the same new secret instead of rotating again.

post/v1/projects/{projectId}/webhooks/connections/{id}/secret/rotate

Request

  • Base URL: https://api.particle.pro
  • URL: https://api.particle.pro/v1/projects/{projectId}/webhooks/connections/{id}/secret/rotate
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

projectIdstring required

Project ID (base62-encoded).

idstring required

Webhook connection ID (base62-encoded).

Headers

Idempotency-Keystring

A key you choose, such as a UUID, to retry this request safely. Resend the same key with the same request and the first response is returned with Idempotent-Replayed: true instead of the request running again, for 24 hours after it succeeded. The same key with a different request returns 422 idempotency_key_reused; a retry while the first request is still running returns 409 idempotency_key_in_use. A request that fails does not use up its key.

Response

OK

created_atstring date-time required
idstring required
namestring

Optional human label for the connection.

project_idstring required
revoked_atstring date-time

Set when the connection was deleted/revoked; absent for active connections. A revoked connection stops delivering and is skipped by alerts that still reference it.

secretstring required

Signing secret — shown only at create/rotate time. Store it securely; it cannot be retrieved again. Used to verify the X-Webhook-Signature header on delivered payloads.

secret_prefixstring required

Masked signing-secret prefix for identification. The full secret is shown only at create/rotate time and cannot be retrieved afterward.

surface'PLATFORM' | 'RADAR' required

Which Particle surface created this connection. Fixed at create time and inferred from the caller's authenticated surface context. Provenance only — an alert on either surface can deliver through it. Render it to show where the endpoint was registered.

urlstring required

Destination URL that signed POSTs are delivered to.

Changes

No recorded changes to this operation across all 2 revisions of this API.