TRtreasuryspring
Webhooks

Rotate your webhook's signing secret

Changed on

Replace your webhook's signing secret, without missing an event or failing a delivery.

The new secret is returned, once. For the next 24 hours each delivery is signed with both the new and the previous secret, so you can switch at your own pace; after that, only with the new one. Rotating again within those 24 hours stops the oldest secret being used straight away.

post/webhook/secret/rotate

Request

  • Base URL
    https://api.treasuryspring.com/api/v1
  • Auth
    HTTP bearer

Response

The webhook, with its new signing secret

previousSecretExpiresAtstring date-time nullable

While a secret rotation is in progress, when deliveries stop also being signed with the previous secret; null otherwise.

secretstring required

The new signing secret, returned only this once; store it securely. For the next 24 hours each delivery is signed with both this and the previous secret.

typesWebhookDataType[] required

What is delivered.

urlstring required

HTTPS endpoint deliveries are POSTed to.

Example response

{
  "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw",
  "types": [
    "EVENT"
  ],
  "url": "https://example.com/webhooks"
}

Changes