Rotate the signing secret

POST 
/projects/:projectId/webhooks/:endpointId/rotate-secret

Issue a new signing secret. The previous secret keeps working for a grace period so you can roll over without dropping deliveries.

Constraints:

• The secret is returned ONCE and cannot be retrieved later — store it before discarding the response.
• During the 24-hour grace window the webhook-signature header carries BOTH signatures, space-separated (v1,<new> v1,<old>). A compliant verifier accepts a payload if any signature matches.

Request

Responses

200

The endpoint and its new signing secret.

404

Endpoint not found.