Skip to main content
POST/api/public/v1/webhooks/{id}/rotate-secret

webhooks.rotate_secret

New signing secret (returned once); the previous one keeps signing for overlap_hours so receivers can switch without missing events.

Capability: webhook.manageCommand (idempotent)MCP tool: webhooks_rotate_secret
View as Markdown

Parameters

NameTypeRequiredDescription
idpathstring (uuid)YesWebhook id
command_idbodystring (uuid)YesClient-generated UUID for this command. Send the same id (and body) again to get the stored receipt instead of a second change; a different body under the same id is CONFLICT.
overlap_hoursbodyintegerNoHow long the previous secret keeps signing (0 = stop now) (min 0, max 168) Default: `24`.

Examples

curl -X POST "https://browlix.com/api/public/v1/webhooks/<id>/rotate-secret" \
  -H "Authorization: Bearer $BROWLIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"command_id":"<uuid>"}'

Response

201 with { data, replayed: false, correlation_id } the first time; 200 with replayed: true when the same command_id and body come again.

The field list of this reply is not published yet; read data as JSON.

Errors

CodeHTTPRetryable
UNAUTHENTICATED401No
FORBIDDEN403No
RATE_LIMITED429Yes
VALIDATION_FAILED422No
NOT_FOUND404No
CONFLICT409No
OUTCOME_UNKNOWN202Yes
DEPENDENCY_UNAVAILABLE503Yes
UNKNOWN500No

Every error code and when to retry

All operations