Rotate a webhook endpoint's signing secret
Generates a new signing secret for the endpoint. The new secret (whsec_…)
is returned in this response and never again — store it immediately. The
previous secret is revoked. Send an Idempotency-Key header.
Authorizations
A merchant secret key (sk_…) sent as Authorization: Bearer <key>.
Headers
Required. A unique key that makes retries safe: the same key with the same request body returns the original response instead of repeating the operation.
255Path Parameters
The webhook endpoint id (whe_…).
Response
The webhook endpoint with its new signing secret.
A webhook endpoint plus its signing secret (whsec_…) — returned only by create and rotate_secret. The secret is shown exactly once; store it immediately. No other response carries it.
webhook_endpoint Current lifecycle state. active means the endpoint is receiving deliveries.
disabled means it is paused by the merchant. deleted means it has been
soft-deleted. error means deliveries were disabled after repeated
failures.
active, disabled, deleted, error true when status is disabled; false otherwise.
Unix epoch seconds.
The signing secret for verifying deliveries. Shown exactly once, in this response.
Unix epoch seconds when the signing secret was last rotated. Null until the first rotation after creation.
Unix epoch seconds when the endpoint was deleted. Null while active.

