Skip to main content
POST
Rotate webhook secret
Generate a new signing secret for a webhook subscription. How it works:
  1. A new secret is generated and becomes active immediately
  2. The old secret remains valid for 24 hours (grace period)
  3. During the grace period, deliveries include BOTH signatures (comma-separated in X-Aura-Signature)
  4. After the grace period, only the new secret is used
Response includes:
  • old_secret - Previous secret (for verifying in-flight deliveries)
  • new_secret - New secret (active immediately)
  • grace_period_ends_at - When the old secret expires
Recommended flow:
  1. Call this endpoint
  2. Update your verification code to accept both secrets
  3. After the grace period, remove old secret from your code

Path Parameters

id
string
required

Webhook subscription ID (UUID)

Example:

"550e8400-e29b-41d4-a716-446655440000"

Response

Secret rotated successfully

grace_period_ends_at
string<date-time>
required

When the old secret will stop being accepted (24h from rotation)

Example:

"2026-03-22T08:00:00Z"

new_secret
string
required

New secret (used immediately for new deliveries)

Example:

"def456..."

old_secret
string
required

Previous secret (valid for 24h to verify in-flight deliveries)

Example:

"abc123..."

rotated_at
string<date-time>
required

When the rotation occurred (ISO 8601)

Example:

"2026-03-21T08:00:00Z"

success
enum<boolean>
required
Available options:
true