Skip to main content
POST
Rotate a webhook subscription's signing secret

Authorizations

Authorization
string
header
required

OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.

Path Parameters

sourcedApplicationId
string<uuid>
required

UUID of the App the subscription is tied to

subscriptionId
string<uuid>
required

UUID of the webhook subscription

Response

Secret rotated (new signing secret returned once)

A webhook subscription plus its plaintext signing secret. Returned only by create and rotate-secret; the secret cannot be retrieved again.

id
string<uuid>
required

Unique identifier of the subscription.

url
string<uri>
required

Consumer endpoint the signed notification is POSTed to.

eventTypes
string[]
required

Event types this subscription receives.

status
enum<string>
required

active = delivering; paused = suspended by the owner; disabled = auto-disabled by the platform after repeated terminal delivery failures.

Available options:
active,
paused,
disabled
dateCreated
string<date-time>
required

When the subscription was created.

signingSecret
string
required

HMAC-SHA256 signing secret (prefixed whsec_). Verify each delivery by computing HMAC-SHA256(secret, timestampHeader + "." + rawBody) and comparing to the signature header. Shown exactly once.