Skip to main content
POST
Rotate secret

Authorizations

Authorization
string
header
required

API key authentication. Use format: Authorization: Bearer tavrn_sk_live_...

Headers

Idempotency-Key
string

Optional opaque key (1-255 characters, a UUID v4 is recommended) that makes a POST safe to retry. Scoped to your organization and kept for 24 hours. A retry with the same key and the same body replays the original status and body with Idempotent-Replayed: true; the same key with a different body returns 422 idempotency_key_reused_with_different_payload; a retry while the first attempt is still running returns 409 idempotency_key_in_use. Only 2xx and 4xx outcomes are stored - a 5xx releases the key so the retry executes again. See the Idempotent requests guide.

Required string length: 1 - 255

Path Parameters

id
string
required

Webhook ID

Response

New secret issued

id
string
required
secret
string
required

New signing secret. Returned only in this response.

Example:

"whsec_…"

secret_hint
string
required
Example:

"...abc1"

previous_secret_expires_at
string<date-time>
required

Until this time deliveries are also signed with the previous secret