Easy Labs
APIAccount & operationsWebhooks

Rotate a webhook endpoint's signing secret

Issue a new signing secret for this endpoint and retire the current one. During the overlap window BOTH secrets verify — deliveries carry one sha256= entry per valid secret, so you can deploy the new one without dropping events. Set overlap_hours to 0 to revoke the old secret immediately, which is what you want if it leaked. The new secret is returned only once.

POST
/v1/api/webhooks/{id}/rotate-secret

Authorization

apiKey
x-easy-api-key<token>

Merchant API key. Publishable keys (pk_test_* / pk_live_) are safe for browser/frontend use and carry a limited scope set (sessions, payment_instruments, customers, orders writes; products, product_prices, payment_links reads). Secret keys (sk_test_ / sk_live_*) grant full admin access and must only be used server-side.

In: header

Path Parameters

id*string
Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://loading/v1/api/webhooks/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate-secret" \  -H "Content-Type: application/json" \  -d '{}'
{
  "success": true,
  "timestamp": "2019-08-24T14:15:22Z",
  "data": null,
  "message": "string",
  "pagination": {
    "total": 0,
    "limit": 1,
    "offset": 0,
    "has_more": true,
    "truncated": true,
    "cursors": {
      "first": "string",
      "last": "string"
    }
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}

Register a webhook endpoint

Register a new webhook endpoint to receive real-time event notifications. The secret is returned only once — store it securely.

Send a test event to a webhook endpoint

Emit a `test.webhook` event so you can verify your endpoint's signature checking and response handling before relying on real events. Delivered through the same queue and signed with the same secrets as any other event, so a successful test proves the real path.