Roll a webhook's secret

Makes a new signing secret; the old one stops signing at once. The new secret is in this answer only.

POST/api/v1/webhooks/{webhook_id}/roll-secret

Authentication

An API key as Authorization: Bearer or x-api-key. It needs the webhooks:manage scope — add, change and delete webhooks.

webhooks:manageChanges the draft or a recordIdempotency-Key requiredMCP tool: roll_webhook_secret

Parameters

Named placeholders go in the path; the rest in a JSON body.

webhook_idstringPath · required: The webhook's id.1 to 100 characters

Response

200 with JSON on success (schema on the right). Errors use the standard envelope; a retry with the same Idempotency-Key gets the first answer back (how retries work).

curl

curl -X POST 'https://websites.workflowcorp.com/api/v1/webhooks/WEBHOOK_ID/roll-secret' \
  -H "Authorization: Bearer $WEBSITEBUDDY_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

Example arguments

{
  "webhook_id": "WEBHOOK_ID"
}

Response schema

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string"
    },
    "url": {
      "type": "string"
    },
    "events": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "site": {
      "anyOf": [
        {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "name": {
              "type": "string"
            }
          },
          "required": [
            "id",
            "name"
          ],
          "additionalProperties": false
        },
        {
          "type": "null"
        }
      ],
      "description": "The one site whose events it hears; null = every site (and your shop orders)."
    },
    "description": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "secret_prefix": {
      "type": "string",
      "description": "The first characters of the signing secret, to tell secrets apart."
    },
    "status": {
      "type": "string",
      "enum": [
        "active",
        "paused"
      ]
    },
    "paused_reason": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "failures_in_a_row": {
      "type": "integer",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991
    },
    "last_success_at": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "last_failure_at": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "is_sample": {
      "type": "boolean"
    },
    "created_at": {
      "type": "string"
    },
    "secret": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "description": "The signing secret (whsec_…) — in this answer only; null when an Idempotency-Key replays it. Store it now."
    }
  },
  "required": [
    "id",
    "url",
    "events",
    "site",
    "description",
    "secret_prefix",
    "status",
    "paused_reason",
    "failures_in_a_row",
    "last_success_at",
    "last_failure_at",
    "is_sample",
    "created_at",
    "secret"
  ],
  "additionalProperties": false
}