> ## Documentation Index
> Fetch the complete documentation index at: https://docs.api.aura-app.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate webhook secret

> 
Generate a new signing secret for a webhook subscription.

**How it works:**
1. A new secret is generated and becomes active immediately
2. The old secret remains valid for 24 hours (grace period)
3. During the grace period, deliveries include BOTH signatures (comma-separated in `X-Aura-Signature`)
4. After the grace period, only the new secret is used

**Response includes:**
- `old_secret` - Previous secret (for verifying in-flight deliveries)
- `new_secret` - New secret (active immediately)
- `grace_period_ends_at` - When the old secret expires

**Recommended flow:**
1. Call this endpoint
2. Update your verification code to accept both secrets
3. After the grace period, remove old secret from your code
  

Generate a new signing secret for a webhook subscription.

**How it works:**

1. A new secret is generated and becomes active immediately
2. The old secret remains valid for 24 hours (grace period)
3. During the grace period, deliveries include BOTH signatures (comma-separated in `X-Aura-Signature`)
4. After the grace period, only the new secret is used

**Response includes:**

* `old_secret` - Previous secret (for verifying in-flight deliveries)
* `new_secret` - New secret (active immediately)
* `grace_period_ends_at` - When the old secret expires

**Recommended flow:**

1. Call this endpoint
2. Update your verification code to accept both secrets
3. After the grace period, remove old secret from your code


## OpenAPI

````yaml openapi.json POST /v1/webhooks/{id}/rotate-secret
openapi: 3.1.0
info:
  contact:
    email: support@aura-app.ai
    name: Aura Support
  description: >-
    # Aura Partner Integrations API


    > **Alpha Release** - This API is under active development. Endpoints,
    request/response schemas, and behaviors may change without prior notice. We
    recommend pinning to specific response fields you need and handling unknown
    fields gracefully.


    Enterprise REST API for external partner integrations including

    commission platforms, external mobile apps, and client booking widgets.


    ## MCP Connector


    Aura also exposes a **Model Context Protocol** server at `/mcp` so AI

    assistants (Claude, ChatGPT) can answer questions about a user's own sales
    data.

    If you are building an assistant integration rather than a server-to-server
    one,

    that is almost certainly the surface you want — it is task-shaped ("prep me
    for

    my next call") rather than resource-shaped, and it handles auth per-user.


    Read-only. OAuth 2.1 + PKCE, with Clerk as the authorization server;
    discover it

    from `/.well-known/oauth-protected-resource`. Setup guide:

    https://docs.api.aura-app.ai/mcp-connector


    ## Authentication


    Authenticated endpoints support two authentication methods:


    **1. API Key (for partners and integrations):**

    ```

    Authorization: Bearer aura_pk_live_xxxxxxxxxxxxxxxx

    ```

    Get your API key from the Aura dashboard at Settings > API Keys.


    **2. Clerk JWT (for mobile and web apps):**

    ```

    Authorization: Bearer <clerk_jwt_token>

    ```

    Use Clerk's authentication SDK to obtain a JWT token with org claims.


    ## Rate Limiting


    - **Per API Key:** 100 requests/minute

    - **Per Organization:** 1000 requests/minute


    Rate limit headers are included in all responses:

    - `X-RateLimit-Limit`: Maximum requests allowed

    - `X-RateLimit-Remaining`: Remaining requests in current window

    - `X-RateLimit-Reset`: Unix timestamp when limit resets


    These counters are held per serving instance, so under concurrency the

    effective ceiling is higher than the number above and the headers describe
    one

    instance's view rather than a global total. Treat a 429 as backpressure to
    obey

    and pace your client to the documented rate — but do not rely on us to
    reject

    your 101st request, and do not derive a global remaining-quota figure from
    the

    headers. The limit may become globally enforced without notice, so a client

    that stays within it will not be affected when that happens.


    ## Pagination


    List endpoints support cursor-based pagination:

    - `limit`: Number of results per page (default: 50, max: 100)

    - `cursor`: Opaque cursor for next page


    ## Error Handling


    All errors follow a standard format:


    ```json

    {
      "success": false,
      "error": "Error message",
      "code": "ERROR_CODE"
    }

    ```


    Common HTTP status codes:

    - **400** Bad Request - Invalid input (`VALIDATION_ERROR`)

    - **401** Unauthorized - Missing or invalid API key (`AUTHENTICATION_ERROR`)

    - **402** Payment Required - The key is valid, but the organization's
    subscription is not active (`PAYMENT_REQUIRED`). Every authenticated
    endpoint can return this. Retrying will not help until the account's payment
    method is updated in Aura; surface it to the account owner rather than
    treating it as an auth failure.

    - **403** Forbidden - Insufficient permissions (`AUTHORIZATION_ERROR`)

    - **404** Not Found - Resource not found (`NOT_FOUND`)

    - **409** Conflict - Resource state prevents the operation (`CONFLICT`)

    - **413** Payload Too Large - Request body exceeds 256KB
    (`PAYLOAD_TOO_LARGE`)

    - **429** Too Many Requests - Rate limit exceeded (`RATE_LIMIT_EXCEEDED`)

    - **500** Internal Server Error - Server error (`INTERNAL_ERROR`)


    ## Webhooks


    Subscribe to real-time events using the Webhooks API. All webhook payloads

    are signed with HMAC-SHA256 for security verification.


    Delivery is at-least-once. Every payload carries an `idempotency_key` that

    is stable across retries of the same event, so you can enforce exactly-once

    with a `(subscription_id, idempotency_key)` unique constraint on your side.


    For full documentation, visit
    [docs.aura-app.ai/api](https://docs.aura-app.ai/api)
  license:
    name: Proprietary
  title: Aura Partner Integrations API
  version: 1.0.0-alpha
servers:
  - description: Production
    url: https://api.aura-app.ai
  - description: Staging
    url: https://staging-api.aura-app.ai
  - description: Local Development
    url: http://localhost:3001
security:
  - bearerAuth: []
tags:
  - description: Lead management operations
    name: Leads
  - description: Call booking and management
    name: Calls
  - description: Booking link configuration (read-only)
    name: Booking Links
  - description: Product catalog (read-only)
    name: Products
  - description: Payment tracking (read-only)
    name: Payments
  - description: Public booking creation
    name: Bookings
  - description: Real-time event subscriptions and webhook management
    name: Webhooks
  - description: >-
      Team member information for commission attribution. **Alpha** - schema may
      change without notice.
    name: Team (Alpha)
  - description: >-
      Dashboard analytics, lead source attribution, and objection analysis.
      **Alpha** - schema may change without notice.
    name: Analytics (Alpha)
  - description: System endpoints (health checks)
    name: System
paths:
  /v1/webhooks/{id}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: Rotate webhook secret
      description: >-

        Generate a new signing secret for a webhook subscription.


        **How it works:**

        1. A new secret is generated and becomes active immediately

        2. The old secret remains valid for 24 hours (grace period)

        3. During the grace period, deliveries include BOTH signatures
        (comma-separated in `X-Aura-Signature`)

        4. After the grace period, only the new secret is used


        **Response includes:**

        - `old_secret` - Previous secret (for verifying in-flight deliveries)

        - `new_secret` - New secret (active immediately)

        - `grace_period_ends_at` - When the old secret expires


        **Recommended flow:**

        1. Call this endpoint

        2. Update your verification code to accept both secrets

        3. After the grace period, remove old secret from your code
          
      parameters:
        - description: Webhook subscription ID (UUID)
          in: path
          name: id
          required: true
          schema:
            description: Webhook subscription ID (UUID)
            example: 550e8400-e29b-41d4-a716-446655440000
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateSecretResponse'
          description: Secret rotated successfully
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: Request validation failed
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: Missing or invalid API key
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '402':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: The organization's subscription is not active
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: The API key does not have the required scope
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookErrorResponse'
          description: Webhook subscription not found
        '408':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: >-
            The request exceeded its processing time limit. Check the outcome
            before retrying a write
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '413':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: The request body exceeds 256KB
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: Rate limit exceeded. Wait before retrying
          headers:
            Retry-After:
              description: Seconds to wait before retrying
              schema:
                type: string
            X-RateLimit-Limit:
              description: Requests allowed in the current window
              schema:
                type: string
            X-RateLimit-Remaining:
              description: Requests remaining in the current window
              schema:
                type: string
            X-RateLimit-Reset:
              description: Window reset as a Unix timestamp
              schema:
                type: string
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MiddlewareErrorResponse'
          description: >-
            Unexpected server failure. Include the request identifier when
            contacting support
          headers:
            X-Request-Id:
              description: Request identifier for support
              schema:
                type: string
      security:
        - bearerAuth: []
components:
  schemas:
    RotateSecretResponse:
      properties:
        grace_period_ends_at:
          description: When the old secret will stop being accepted (24h from rotation)
          example: '2026-03-22T08:00:00Z'
          format: date-time
          type: string
        new_secret:
          description: New secret (used immediately for new deliveries)
          example: def456...
          type: string
        old_secret:
          description: Previous secret (valid for 24h to verify in-flight deliveries)
          example: abc123...
          type: string
        rotated_at:
          description: When the rotation occurred (ISO 8601)
          example: '2026-03-21T08:00:00Z'
          format: date-time
          type: string
        success:
          enum:
            - true
          type: boolean
      required:
        - success
        - old_secret
        - new_secret
        - rotated_at
        - grace_period_ends_at
      type: object
    MiddlewareErrorResponse:
      properties:
        code:
          type: string
        error:
          type: string
        requestId:
          type: string
        success:
          enum:
            - false
          type: boolean
      required:
        - success
        - error
        - code
      type: object
    WebhookErrorResponse:
      properties:
        code:
          description: Machine-readable error code
          example: WEBHOOK_NOT_FOUND
          type: string
        error:
          description: Human-readable error message
          example: Webhook subscription not found
          type: string
        success:
          enum:
            - false
          type: boolean
      required:
        - success
        - error
      type: object

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.