Webhook endpoints

Create a new secret

Replace the signing secret without downtime.

POST/v1/webhook-endpoints/{id}/rotate-secret

Both secrets sign messages for 24 hours, so you have time to update your server.

Authentication

A signed-in session: the cookie from Log in. Changes also need the X-CSRF-Token header.

Path parameters

idstringrequired

The endpoint's ID.

Response

200 OK

secretstring

The new signing secret.

previous_secret_expires_atstring

When the old one stops working.

noticestring

A reminder to update your server.

Errors

Status	Code	What to do
401	`unauthenticated`	Log in first, or log in again.
403	`csrf_failed`	Send the `csrf_token` as `X-CSRF-Token`.
404	`not_found`	Check the ID. It may belong to another workspace.

Request

curl -b session.txt -X POST "https://rasternivo-api.swiftinfocorp.com/v1/webhook-endpoints/ENDPOINT_ID/rotate-secret" \
  -H "X-CSRF-Token: CSRF_TOKEN"

Response 200

{
  "secret": "whsec_…",
  "previous_secret_expires_at": "2026-11-03T08:31:50Z",
  "notice": "Both secrets sign deliveries until the previous one expires. Update your receiver before then."
}