Rotate a webhook's secret
Replaces the webhook's signing secret and returns the new one; this response is the only time it is shown.
The previous secret stops working at once, so deploy the new one right after rotating.
Guide: Webhook delivery
AuthorizationBearer <token>
A project secret key: vh_sk_... for production, vh_sk_test_... for test. Keep it on your servers.
In: header
Path parameters
projectId*string
The project's id, proj_.... A secret key works only in the project it belongs to.
webhookId*string
The webhook's id, wh_ep_....
Examples
curl -X POST "https://api.voidhash.com/api/v1/projects/proj_tz4a98xxat96iws9zmbrgj3a/webhooks/wh_ep_q5w8e2r7t1y4u9i3o6p0a2s5/rotate" \ -H "Authorization: Bearer vh_sk_..."{ "id": "wh_ep_q5w8e2r7t1y4u9i3o6p0a2s5", "projectId": "proj_tz4a98xxat96iws9zmbrgj3a", "name": "Orders backend", "description": null, "url": "https://example.com/webhooks/voidhash", "events": [ "subscription.created", "subscription.renewed", "purchase.refunded" ], "environment": "production", "status": "active", "consecutiveFailures": 0, "lastSuccessAt": "2026-03-14T09:31:54.000Z", "createdAt": "2026-03-01T10:00:00.000Z", "secret": "whsec_..."}{ "error": { "type": "invalid_request", "code": "string", "message": "string", "param": "string" }}{ "error": { "type": "unauthenticated", "code": "invalid_api_key", "message": "This secret key is not valid." }}{ "error": { "type": "permission_denied", "code": "permission_denied", "message": "Insufficient permissions." }}{ "error": { "type": "not_found", "code": "project_not_found", "message": "There is no project proj_tz4a98xxat96iws9zmbrgj3a, or this credential cannot use it.", "param": "projectId" }}{ "error": { "type": "internal", "code": "internal_error", "message": "Something went wrong on our side. Try again, and contact support with the Request-Id header if it keeps failing." }}Response body
application/json
application/json
application/json
application/json
application/json
application/json
Errors
This operation adds no error codes of its own. It can fail with the errors every operation shares, such as unauthenticated; see Errors.
More in Webhooks
- List webhooks
GET - Create a webhook
POST - Retrieve a webhook
GET - Update a webhook
PATCH - Delete a webhook
DELETE - Send a test event
POST - List a webhook's deliveries
GET - Retrieve a webhook delivery
GET - Retry a webhook delivery
POST
Something wrong or missing on this page? Tell us by email or on Discord.