Replace a webhook's signing secret

POST

/event-subscriptions/{id}/rotate-secret

const url = 'https://app.surveyrock.com/api/v1/event-subscriptions/example/rotate-secret';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://app.surveyrock.com/api/v1/event-subscriptions/example/rotate-secret \
  --header 'Authorization: Bearer <token>'

Generates a new secret and returns it once in data.secret. The previous secret keeps signing for 24 hours alongside the new one (the webhook-signature header carries both), so a receiver can switch without missing a delivery; previous_secret_expires_at says when. Rotating again inside that window drops the older secret. Not covered by Idempotency-Key, because that would store the secret.

The workspace’s owners and admins are emailed.

Authorizations

bearerAuth
events:write

Parameters

Path Parameters

required

string

Responses

200

data.secret is the new signing secret, shown once

403

The plan does not include webhooks (feature_locked), or the token lacks events:write

404

subscription_not_found

409

subscription_is_pull: an event feed has no secret