Rotate a webhook destination's signing secret

Mint a new signing secret for one destination. The new secret signs immediately and is returned in this response and never again. The previous secret keeps signing alongside it for 24 hours, and every delivery in the overlap carries both signatures. Switch the receiver to the new secret inside that window. Rotating again during an overlap replaces the previous secret at once: only the last two secrets ever sign.

post/v1/webhooks/{webhook_id}/rotate

Request

  • Base URL: https://thirds.ai
  • URL: https://thirds.ai/v1/webhooks/{webhook_id}/rotate
  • Auth: HTTP bearer

Path parameters

webhook_idstring required

The destination's public identifier, such as "wh_1f8b3c7d5e2a49061f8b3c7d5e2a4906".

Response

The destination with its new secret. This is the only response, with creation's, that ever carries the signing secret.

idstring required

The destination's public identifier: "wh_" followed by 32 lowercase hexadecimal characters.

urlstring uri required
eventsstring[] required

The selected events, always sorted and distinct.

status'enabled' | 'disabled' required
disabled_reason'owner_request' | 'delivery_failure' | 'null' nullable required

Why a disabled destination is disabled: the owner asked, or delivery failed repeatedly. Null while the destination is enabled.

display_prefixstring required

The first characters of the signing secret, enough to tell destinations apart in a list.

last_delivery_atstring date-time nullable required

Time of the most recent recorded attempt, including tests.

failure_countinteger required

Consecutive normal delivery failures. A success or enable resets it. Test events do not change it.

created_atstring date-time required
previous_secret_expires_atstring date-time nullable required

Set while a rotation overlap is running: until this instant every delivery also carries a signature made with the previous secret.

secretstring required

The full signing secret: "thirds_whsec_" followed by 64 lowercase hexadecimal characters. It is shown here once and never again; store it and verify every delivery's Thirds-Signature header with it.

Changes

No recorded changes to this operation across all 1 revision of this API.