Skip to content
rigid.fi

Rotate webhook signing secret

POST/v1/webhook-endpoints/{id}/rotate-secret

Requires an API client bearer token.

Rotates the signing secret for a webhook endpoint. The previous secret remains valid during a grace-window period (dual-verify). The new secret is returned ONCE, on this response only. Requires an Idempotency-Key header.

Parameters

Path parameters

NameRequiredDescription
idrequired

Header parameters

NameRequiredDescription
Idempotency-Keyrequired

Client-chosen. An identical retry with the same key returns the stored response; reusing the key with a different payload returns 409.

Example

curl -X POST https://api.rigid.fi/v1/webhook-endpoints/{id}/rotate-secret \
  -H "Authorization: Bearer $RIGID_API_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)"

Responses

200

Rotated endpoint with its one-time-visible new signing secret.

idstringrequired
urlstringrequired
event_typesarray of stringrequired
activebooleanrequired
created_atstringrequired
programme_idstring (uuid) | nullrequired
secretstringrequired
400

Validation error

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
401

Authentication required

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
403

Forbidden

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
404

Webhook endpoint not found

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
409

Idempotency-Key reused with a different payload

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
500

Internal server error

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring