FurniOpsDocs
API referenceWebhooks

Rotate an endpoint's secret

Makes a new signing secret, shown once in the answer. The current secret keeps signing beside it for overlap_hours (default 24), so deliveries carry both signatures until the receiver has switched. A secret already rotated out is retired at once.

POST/v1/webhook-endpoints/{id}/rotate-secret

Makes a new signing secret, shown once in the answer. The current secret keeps signing beside it for overlap_hours (default 24), so deliveries carry both signatures until the receiver has switched. A secret already rotated out is retired at once.

Authorization

apiKey
AuthorizationBearer <token>

An API key (fo_live_… / fo_test_…) as a bearer token

In: header

Path Parameters

id*string

Webhook endpoint ID

Match^whe_[0-9A-Za-z]{22}$

Header Parameters

FurniOps-Version?string

Dated API version; pinned per organisation on first use and overridable per request

Value in

  • "2026-10-01"
  • "2026-10-04"
FurniOps-Mode?string

The data the request acts on: test is the organisation's sandbox. An OAuth token picks it (live by default); an API key's mode is fixed, and naming the other one is refused

Value in

  • "live"
  • "test"
Idempotency-Key*string

Unique key for this operation, reused on retries (24 h)

Length1 <= length <= 257
FurniOps-Dry-Run?string

Preview the write and change nothing: true answers the would-be response, explain a Preview (application/vnd.furniops.preview+json)

Value in

  • "true"
  • "explain"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

How to retire the current secret

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/webhook-endpoints/string/rotate-secret" \  -H "Idempotency-Key: string" \  -H "Content-Type: application/json" \  -d '{}'
{  "object": "webhook_endpoint",  "id": "string",  "url": "string",  "description": "string",  "event_types": [    "string"  ],  "filters": {    "catalogues": [      "string"    ],    "sources": [      "string"    ],    "categories": [      "string"    ]  },  "coalesce_seconds": 0,  "payload": "thin",  "api_version": "2026-10-01",  "status": "enabled",  "status_reason": {    "code": "failing",    "message": "string",    "at": "2019-08-24T14:15:22Z"  },  "secrets": [    {      "hint": "string",      "created_at": "2019-08-24T14:15:22Z",      "expires_at": "2019-08-24T14:15:22Z"    }  ],  "livemode": true,  "version": 1,  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "secret": "string"}

Send a delivery again POST

Queues a finished delivery (failed or succeeded) to be sent again at once, with the same `webhook-id` (receivers that already have it may ignore it) and a fresh schedule. A delivery still pending or being sent is answered as it is. The endpoint must be enabled (409).

Send a test event POST

Sends a `webhook.test` event to the endpoint now, signed like any other, whatever it subscribes to. Follow it with `GET /v1/webhook-endpoints/{id}/deliveries/{delivery}`.