Rotate an endpoint's signing secret

POST

/webhooks/endpoints/{endpointId}/rotate-secret

Mints a fresh signing secret. The outgoing secret keeps signing
deliveries alongside the new one for a 24-hour overlap window (during
which webhook-signature carries two v1,<sig> pairs), so you have
real time to roll the new value into your receiver's verification
before the old one stops working. The new raw secret is returned
exactly once, in this response only.

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Path Params

Responses

🟢200OK

application/json

The secret was rotated.

Bodyapplication/json

🟠401Unauthorized

🟠403Forbidden

🟠404Record Not Found

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST 'https://upload.tf/api/v1/webhooks/endpoints//rotate-secret' \
--header 'x-api-key: <api-key>'

Response Example

200 - Example 1

{
    "success": true,
    "data": {
        "endpoint": {
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
            "url": "http://example.com",
            "eventTypes": [
                "page.published"
            ],
            "apiVersion": "2026-08-08",
            "enabled": true,
            "consecutiveFailures": 0,
            "lastSuccessAt": "2019-08-24T14:15:22.123Z",
            "lastFailureAt": "2019-08-24T14:15:22.123Z",
            "lastAttemptAt": "2019-08-24T14:15:22.123Z",
            "disabledAt": "2019-08-24T14:15:22.123Z",
            "disabledReason": "string",
            "createdAt": "2019-08-24T14:15:22.123Z",
            "updatedAt": "2019-08-24T14:15:22.123Z"
        },
        "secret": "string"
    }
}

Modified at 2026-08-18 09:08:48

Delete a webhook endpoint

List deliveries (the delivery log)