Rotate an endpoint secret

Creates a new signing secret. The previous secret remains valid for one day.

POST/v1/webhook-endpoints/{id}/rotate-secret

Requires webhooks:write permission.

Path parameters

idstringrequired

The id of the endpoint (whk_…).

Example: whk_01k7q3m8x2v5t9n4b6c1d0e7fa

Prefixed with whk_.

Response (200)

dataobjectrequired

The returned object, or an array of objects for a list.

secretstringrequired

The signing secret, whsec_…. It is in this answer only: store it now.

Example: whsec_k3f9…

previous_secret_retires_atstringrequired

When the replaced secret stops signing, a day after the rotation.

Example: 2026-10-26T03:04:05.000Z

Format: date-time

metaobjectrequired

Request details such as its id and pagination cursor.

request_idstringrequired

The id of this request. Quote it when you ask support about it.

Example: req_Hy3k9QzT2LmN8vXa

A failed request answers with the common error shape; see Errors.

Request
Response

curl -X POST "https://api.baiyar.com/v1/webhook-endpoints/{id}/rotate-secret" \
  -H "Authorization: Bearer $BAIYAR_KEY"

{
  "data": {
    "secret": "whsec_k3f9…",
    "previous_secret_retires_at": "2026-10-26T03:04:05.000Z"
  },
  "meta": {
    "request_id": "req_Hy3k9QzT2LmN8vXa"
  }
}