Skip to main content
POST
Rotate a webhook secret

Authorizations

Authorization
string
header
required

An organization-scoped API key, minted in control under Settings → API keys. Every failure to authenticate answers one identical 401: "Provide a valid organization-scoped API key or an active session." Each operation names the one scope it is filed under, <resource>:<read|write>, where the resource is the first path segment after /api/v1/; a key minted today carries all 22 of them. Scopes are RECORDED — on the key and on every audit row — and are not yet enforced: no request is refused for want of one.

Headers

Idempotency-Key
string

Any unique string.

Path Parameters

id
string
required

The webhook id. A malformed id answers 404, exactly as another organization's well-formed id does.

Body

application/json
secretKind
enum<string>

header (absent) mints a whsec_… secret the sender puts in Authorization: Bearer. link mints a whlnk_… secret carried in the URL, for a sender that takes only a web address (Calendly, Cal.com), and answers link beside secret. A rotate without link turns a link webhook into a header one.

Available options:
header,
link

Required, and true, with secretKind: "link": you accept that the tool you paste the link into keeps a copy of it, and that a link carrying a secret is less safe than a secret sent in a header. Without it the call is a 400 and nothing is changed.

Response

Success.

data
object
required