Rotate the signing secret

POST/api/v1/webhooks/{id}/rotate-secret

scope webhooks:manage

Replaces the signing secret immediately and returns the new one ONCE. Deliveries signed with the old secret stop verifying the moment this returns — update the receiver first, then rotate. There is no grace period.

Path parameters

Name	Type	Description
`id`required	`string (uuid)`	Webhook endpoint id

Request

curl -X POST "https://your-crm.example.com/api/v1/webhooks/3a4b5c6d-7e8f-4a9b-8c0d-1e2f3a4b5c6d/rotate-secret" \
  -H "Authorization: Bearer $RAABTA_API_KEY"

Response · 200 OK

{
  "data": {
    "endpoint": {
      "id": "3a4b5c6d-7e8f-4a9b-8c0d-1e2f3a4b5c6d",
      "url": "https://example.com/hooks/raabta",
      "description": "Sync contacts and deals into our warehouse",
      "events": [
        "contact.created",
        "contact.updated",
        "deal.stage_changed"
      ],
      "enabled": true,
      "api_version": "2026-09-01",
      "secret_last4": "Kx2P",
      "consecutive_failures": 0,
      "disabled_at": null,
      "disabled_reason": null,
      "last_success_at": "2026-09-02T10:06:00.000Z",
      "last_error": null,
      "last_error_at": null,
      "created_at": "2026-09-01T08:00:00.000Z",
      "updated_at": "2026-09-02T10:06:00.000Z"
    },
    "secret": "whsec_9Lm3nQr7sT1uV5wX8yZ2aB4cD6eF0gH3iJ5kL7mN9oP1qKx2P"
  }
}

Response

Wrapped in { data: … }

Name	Type	Description
`endpoint`required	`object`
`endpoint.id`required	`string (uuid)`	UUID
`endpoint.url`required	`string`	Where events are POSTed
`endpoint.description`required	`string \| null`
`endpoint.events`required	`string[]`	Subscribed event types
`endpoint.enabled`required	`boolean`	false = nothing is delivered; pending deliveries wait
`endpoint.api_version`required	`string`	The payload version this endpoint receives
`endpoint.secret_last4`required	`string`	The last four characters of the signing secret
`endpoint.consecutive_failures`required	`integer`	Unbroken run of failed deliveries; reset to 0 on success
`endpoint.disabled_at`required	`string (date-time) \| null`
`endpoint.disabled_reason`required	`string \| null`	Why it is off — `auto: …` when the platform switched it off
`endpoint.last_success_at`required	`string (date-time) \| null`
`endpoint.last_error`required	`string \| null`
`endpoint.last_error_at`required	`string (date-time) \| null`
`endpoint.created_at`required	`string (date-time)`	ISO 8601 timestamp
`endpoint.updated_at`required	`string (date-time)`	ISO 8601 timestamp
`secret`required	`string`	The signing secret — shown ONCE. Store it; it cannot be retrieved later

Errors

Status	Code	When
400	`validation_error`	The body or query failed validation. `details` lists each failing field with a `path` and a `message`.
401	`unauthorized`	No usable API key: the Authorization header is missing or malformed, or the key is unknown, revoked or expired. The three are deliberately indistinguishable.
403	`forbidden`	The key is valid but lacks the scope this endpoint requires, or the request came from an address outside the key’s IP allowlist. The message says which.
403	`account_suspended`	The account this key belongs to is suspended. Rotating the key will not help; contact support.
404	`not_found`	No such resource in this account. A resource that exists in another account also returns this.
429	`rate_limited`	The per-key budget, or the per-IP budget for failed authentication, is exhausted. Honour `Retry-After` before retrying.
500	`internal`	Something failed on our side. Safe to retry with the same Idempotency-Key; quote `request_id` if it persists.