endpoints

Rotate webhook endpoint secret

Mint a new HMAC signing secret for the endpoint and return it in the response secret field (shown exactly once). The previous secret stops signing immediately, so accept both during your cutover window.

post/v1/webhooks/endpoints/{webhook_endpoint_id}/rotate-secret

Request

  • Base URL: https://api.speechify.ai
  • URL: https://api.speechify.ai/v1/webhooks/endpoints/{webhook_endpoint_id}/rotate-secret
  • Auth: HTTP bearer

Path parameters

webhook_endpoint_idstring required

Webhook endpoint id (prefixed whe_…).

Headers

Speechify-Versionstring

Response

The endpoint, including its new one-time signing secret.

idstring required

Prefixed wire id (whe_<26 char Crockford base32>).

urlstring uri required

HTTPS destination Speechify POSTs signed events to.

project_idstring nullable

The project whose events this endpoint receives (prefixed external id). Null means workspace-wide - it receives every project's events. Endpoints have no Default project.

An event is routed by the project frozen on the row that produced it (an API key's project, for example), and for a project.spend_budget.* event the project itself. Workspace-level events such as workspace.spend_budget.* belong to no project and reach workspace-wide endpoints only, so a scoped endpoint subscribed to those alone is refused with a 400 naming enabled_events rather than accepted and never delivered to. A scoped endpoint records no delivery for another project's events.

enabled_eventsstring[] required

The events this endpoint receives: a list of catalog event names (for example workspace.spend_budget.warning) or ["*"] for every event, current and future.

includestring[] required

Per-event payload shaping. Deliveries are lean by default: data.object carries only the resource GET snapshot. List heavy collections here to have them appended under the event's data alongside object, so receivers behind hard request-size caps stay lean unless they opt in. An event's documentation names the keys it recognises. Empty = lean.

api_versionstring date required

The dated payload shape this endpoint receives (YYYY-MM-DD), the same versioning vocabulary the REST API uses. Every delivery is rendered back to this version and carries it in the Speechify-Version header and the payload's top-level version field. Defaults to your workspace's current version at creation; change it to opt into a newer shape.

descriptionstring nullable

Optional human-readable label for the endpoint.

disabledboolean required

When true, Speechify stops delivering to this endpoint.

secretstring

The HMAC-SHA256 signing secret (whsec_…) used to verify the Speechify-Signature header. Returned ONLY when the endpoint is created or its secret is rotated — it is never shown again.

created_atstring date-time required
updated_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.