SpyBara
Go Premium

resources/webhooks/methods/rotate_secret/index.md 2026-09-15 22:59 UTC to 2026-09-16 22:58 UTC

This page contains 83 additions and 0 deletions.

2026
Wed 16 22:58 Fri 18 22:59

Rotate Webhook Endpoint Signing Secret

post /webhook_endpoints/{webhook_endpoint_id}/rotate_secret

Rotates the signing secret for a webhook endpoint in the authenticated project.

Path Parameters

  • webhook_endpoint_id: string

Body Parameters

  • keep_old_secret_active_for_24_hours: optional boolean

    Whether to keep the previous signing secret valid for 24 hours after rotation. Defaults to false, which invalidates the previous secret immediately.

Returns

  • WebhookEndpointWithSecret object { id, created_at, event_types, 6 more }

    • id: string

      The unique ID of the webhook endpoint.

    • created_at: number

      The Unix timestamp when the endpoint was created.

    • event_types: array of string

      The event types that trigger deliveries to this endpoint.

    • name: string

      The human-readable name of the endpoint.

    • object: "webhook_endpoint"

      The object type, which is always webhook_endpoint.

      • "webhook_endpoint"

    • signing_secret: string

      The endpoint's signing secret. This is returned only when the endpoint is created or the secret is rotated.

    • signing_secret_hint: string or null

      A masked hint for the endpoint's signing secret.

    • url: string

      The HTTPS URL that receives webhook deliveries.

    • updated_at: optional number

      The Unix timestamp of the last endpoint configuration or signing-secret change. Initialized at creation; tests and unchanged updates do not advance it.

Example

curl https://api.openai.com/v1/webhook_endpoints/$WEBHOOK_ENDPOINT_ID/rotate_secret \
    -X POST \
    -H "Authorization: Bearer $OPENAI_API_KEY"

Response

{
  "id": "id",
  "created_at": 0,
  "event_types": [
    "string"
  ],
  "name": "name",
  "object": "webhook_endpoint",
  "signing_secret": "signing_secret",
  "signing_secret_hint": "signing_secret_hint",
  "url": "url",
  "updated_at": 0
}