POST /v1/webhooks/{webhook_id}/rotate-secret

Issue a new signing secret. The old one keeps working for 24 hours. The new secret is returned once, here. For the next 24 hours every delivery is signed with both: the new secret in `X-Webhook-Signature` / `X-PuntersEdge-Signature`, the previous one in `X-Webhook-Signature-Previous` / `X-PuntersEdge-Signature-Previous`, so you can deploy the new secret to your receiver without missing a delivery. Delivery is at-least-once: the same event can arrive more than once, so deduplicate on `event_id` (in the body, and sent as the `X-PuntersEdge-Id` and `Idempotency-Key` headers). There is no ordering guarantee between events. Each delivery carries `X-PuntersEdge-Timestamp`, `X-PuntersEdge-Attempt` and two signatures: `X-Webhook-Signature: sha256=<hex>` (HMAC-SHA256 of the raw body with your secret) and `X-PuntersEdge-Signature: t=<unix seconds>,v1=<hex>` (HMAC-SHA256 of `<t>.<raw body>`; refuse a `t` more than 5 minutes from now to block replays). Any 2xx answer is success. A 5xx, 408, 429, timeout or connection failure is retried after 1 min, 5 min, 30 min, 2 h, 6 h (6 tries in all, about 8.5 hours), honouring `Retry-After` up to the next step; any other answer is final. After 10 consecutive undeliverable events, or a day of continuous failure, the subscription is paused and the owner is emailed; POST /v1/webhooks/{id}/resume restarts it with the same secret, and POST /v1/webhooks/{id}/replay re-sends what was missed. The delivery log returns the newest 50 rows unless `limit` says otherwise.

Request

curl -X POST 'https://api.puntersedge.online/v1/webhooks/YOUR_WEBHOOK_ID/rotate-secret' \
  -H 'X-API-Key: YOUR_KEY'

Parameters

Responses

Status codes: 200, 401, 402, 403, 422, 429, 500. Response bodies are JSON; the full schema is in /openapi.json.

Example response

200 application/json Field names and types are as the API returns them; values are a real sample, trimmed to a few items.

{
  "id": "wh_7c1d2e9a4b3f",
  "secret": "whsec_EXAMPLE_ONLY_shown_once_at_creation",
  "previous_secret_expires_at": "2026-10-14T06:00:00+00:00"
}

Related endpoints

• GET /v1/webhooks — List Webhooks
• POST /v1/webhooks — Create Webhook
• DELETE /v1/webhooks/{webhook_id} — Delete Webhook
• GET /v1/webhooks/{webhook_id}/deliveries — List Webhook Deliveries
• POST /v1/webhooks/{webhook_id}/replay — Replay Webhook
• POST /v1/webhooks/{webhook_id}/resume — Resume Webhook
• POST /v1/webhooks/{webhook_id}/test — Test Webhook