Agent

Rotate webhook signing secret

Generates a fresh HMAC signing secret. Returned EXACTLY once in webhook_signing_secret. Previous secret remains valid for 24 hours (dual-secret grace). Requires operator_passkey assurance.

post/agent/v1/webhook-secret/rotate

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/agent/v1/webhook-secret/rotate
  • Auth: API key in header SIGN-IN-WITH-X

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Response

Secret rotated

webhook_signing_secretstring

Plaintext — store immediately, will not be shown again

rotated_atstring date-time
grace_window_hoursinteger
notestring

Example response

{
  "grace_window_hours": 24
}

Changes

No recorded changes to this operation across all 1 revision of this API.