Rotate a trigger’s web address

POST/api/v1/triggers/{id}/token

scope assistants:write

Mints a new address for a webhook trigger and invalidates the old one immediately — the fix if an address leaks. Shown once. Any other kind of trigger returns 422 with reason: not_a_webhook_trigger.

Path parameters

Name	Type	Description
`id`required	`string (uuid)`	Trigger id

Request

curl -X POST "https://your-crm.example.com/api/v1/triggers/4b5c6d7e-8f9a-4b0c-8d1e-2f3a4b5c6d7e/token" \
  -H "Authorization: Bearer $RAABTA_API_KEY"

Response · 200 OK

{
  "data": {
    "trigger": {
      "id": "4b5c6d7e-8f9a-4b0c-8d1e-2f3a4b5c6d7e",
      "assistant_id": "8f2c1d3e-4a5b-4c6d-9e0f-1a2b3c4d5e6f",
      "name": "Weekly no-show follow-up",
      "enabled": true,
      "kind": "webhook",
      "goal": "Message anyone who missed an appointment this week and offer to rebook.",
      "period": null,
      "send_time": null,
      "day_of_week": null,
      "day_of_month": null,
      "run_at": null,
      "event_key": null,
      "audience_type": "none",
      "contact_id": null,
      "segment_id": null,
      "max_targets": 50,
      "respect_quiet_hours": true,
      "last_fired_at": "2026-09-01T10:00:00.000Z",
      "last_error": null,
      "created_at": "2026-08-10T12:00:00.000Z",
      "updated_at": "2026-09-01T10:00:00.000Z"
    },
    "webhook_url": "https://your-crm.example.com/api/ai/triggers/hook/raabta_hook_9f8e7d6c5b4a"
  }
}

Response

Wrapped in { data: … }

Name	Type	Description
`trigger`required	`object`	The trigger as stored
`trigger.id`required	`string (uuid)`	Trigger id
`trigger.assistant_id`required	`string (uuid)`	The assistant this fires
`trigger.name`required	`string`	Trigger name
`trigger.enabled`required	`boolean`	Triggers are created switched OFF; enable them explicitly
`trigger.kind`required	`string (enum)`	What wakes the assistant`recurringonceeventwebhook`
`trigger.goal`required	`string`	What the assistant is asked to do when this fires
`trigger.period`required	`string (enum) \| null`	Recurring triggers only`dailyweeklymonthly`
`trigger.send_time`required	`string \| null`	Recurring only, as HH:MM in the account timezone
`trigger.day_of_week`required	`integer \| null`	Recurring weekly, where 0 is Sunday
`trigger.day_of_month`required	`integer \| null`	Recurring monthly, 1 to 31, clamped to the end of a short month
`trigger.run_at`required	`string (date-time) \| null`	One-off triggers only: when it fires
`trigger.event_key`required	`string \| null`	Event triggers only: which event, from the catalogue
`trigger.audience_type`required	`string (enum)`	Who a firing acts on`nonecontactsegment`
`trigger.contact_id`required	`string (uuid) \| null`	Set when the audience is a single contact
`trigger.segment_id`required	`string (uuid) \| null`	Set when the audience is a segment
`trigger.max_targets`required	`integer`	Ceiling on runs started per firing, 1 to 500
`trigger.respect_quiet_hours`required	`boolean`	Defer a firing that lands outside the account sending hours
`trigger.last_fired_at`required	`string (date-time) \| null`	When it last fired
`trigger.last_error`required	`string \| null`	Why the last firing produced no run, if it produced none
`trigger.created_at`required	`string (date-time)`	When it was created
`trigger.updated_at`required	`string (date-time)`	When it was last edited
`webhook_url`required	`string \| null`	For a webhook trigger, the callable address. Returned ONCE, on create and on rotate, and never readable again; null for every other kind

Errors

Status	Code	When
400	`validation_error`	The body or query failed validation. `details` lists each failing field with a `path` and a `message`.
401	`unauthorized`	No usable API key: the Authorization header is missing or malformed, or the key is unknown, revoked or expired. The three are deliberately indistinguishable.
403	`forbidden`	The key is valid but lacks the scope this endpoint requires, or the request came from an address outside the key’s IP allowlist. The message says which.
403	`account_suspended`	The account this key belongs to is suspended. Rotating the key will not help; contact support.
404	`not_found`	No such resource in this account. A resource that exists in another account also returns this.
422	`unprocessable`	The request was well-formed but cannot be carried out. `reason` is a stable string saying why (for example `outside_window` or `stage_not_in_pipeline`).
429	`rate_limited`	The per-key budget, or the per-IP budget for failed authentication, is exhausted. Honour `Retry-After` before retrying.
500	`internal`	Something failed on our side. Safe to retry with the same Idempotency-Key; quote `request_id` if it persists.