Webhooks

Rotate a webhook signing secret

POST/v1/webhooks/{id}/rotate-secret

Requires an API key with the webhooks:write scope. About keys and scopes

Returns a new secret once. For 24 hours requests carry signatures from both the new and the old secret, so the receiver can switch without dropping events.

Path parameters

idstringrequired: uuid

Returns

Returns 200 OK with a CreatedWebhook in data. Otherwise returns an error; Errors lists every code and which to retry.

idstringrequired

uuid

urlstringrequired

uri

eventsstring[]required

The event types it receives.

sourcestring | nullrequired

The integration that created it; null when created directly.

one of zapier, make, n8n, http_api

statusstringrequired

disabled is set only by the platform; active re-enables it.

one of active, paused, disabled

previousSecretExpiresAtstring | nullrequired

Until when the replaced secret still signs requests after a rotation.

date-time

circuitOpenUntilstring | nullrequired

While set and in the future, deliveries to this endpoint wait: it failed five requests in a row. The next request after it is a probe; a success clears it.

date-time

createdAtstringrequired

date-time

secretstringrequired

Signs every delivery; shown once, here.

curl -X POST https://api.kirora.io/v1/webhooks/018f2a4e-6b1c-7d3e-9f40-37386ae05a6b/rotate-secret \
  -H "Authorization: Bearer $KIRORA_API_KEY"

const response = await fetch('https://api.kirora.io/v1/webhooks/018f2a4e-6b1c-7d3e-9f40-37386ae05a6b/rotate-secret', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.KIRORA_API_KEY}`,
  },
});
const { data } = await response.json();

import os

import requests

response = requests.post(
    "https://api.kirora.io/v1/webhooks/018f2a4e-6b1c-7d3e-9f40-37386ae05a6b/rotate-secret",
    headers={
        "Authorization": f"Bearer {os.environ['KIRORA_API_KEY']}",
    },
)
data = response.json()["data"]

package main

import (
	"encoding/json"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest("POST", "https://api.kirora.io/v1/webhooks/018f2a4e-6b1c-7d3e-9f40-37386ae05a6b/rotate-secret", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("KIRORA_API_KEY"))

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out struct {
		Data json.RawMessage `json:"data"`
	}
	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
		panic(err)
	}
}

Response · 200

{
  "data": {
    "id": "018f2a4e-6b1c-7d3e-9f40-37386ae05a6b",
    "url": "https://example.com",
    "events": [
      "*"
    ],
    "source": "zapier",
    "status": "active",
    "previousSecretExpiresAt": "2030-03-14T09:30:00Z",
    "circuitOpenUntil": "2030-03-14T09:30:00Z",
    "createdAt": "2030-03-14T09:30:00Z",
    "secret": "secret_example"
  }
}

Example values are generated from the schema.