Rotate a webhook secret

POST

/v1/webhook-endpoints/{id}/rotate-secret

curl --request POST \
  --url https://api.inboxcnx.com/v1/webhook-endpoints/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate-secret \
  --header 'Authorization: Bearer <token>'

Replaces a webhook endpoint’s signing secret, for a leaked secret or a scheduled rotation. Returns the new secret once. The body is optional: { "gracePeriodHours": 0..168 }, default 24. During the grace period every request carries two signatures, one per secret, so a receiver can switch without losing a request. 0 replaces the secret at once. Rotating again ends the earlier grace period.

Requires the write:webhooks scope.

Authorizations

• apiKey

Parameters

Path Parameters

id

required

string format: uuid

Responses

200

The endpoint, with its new signing secret (returned only here)

Media typeapplication/json

object

id

required

string

url

required

string

description

required

string | null

events

required

Array<string>

createdAt

required

string

updatedAt

required

string

secret

string

Example

{
  "id": "3f9a1c7e-2b4d-4e8f-a6c0-9d1e2f3a4b5c",
  "url": "https://hooks.example.com/inboxcnx",
  "description": "Production receiver",
  "events": [
    "message.received",
    "grant.created"
  ],
  "createdAt": "2026-10-20T09:15:00.000Z",
  "updatedAt": "2026-10-23T08:00:00.000Z",
  "secret": "whsec_<shown once, store it now>"
}

400

gracePeriodHours out of range

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

The credential lacks the write:webhooks scope

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

No such endpoint for the caller’s application

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

409

tenant_key_pending: the organization is still being set up; retry in a few minutes

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}