Rotate a webhook subscription's signing secret
Issues a new signing secret and returns it once. The previous secret keeps verifying for a rotation window (so in-flight deliveries signed with the old secret still validate), then expires.
The caller must hold the app:manage_webhooks grant on urn:app:<sourcedApplicationId>.
Authorizations
OAuth 2.0 client credentials flow. Contact timeback@trilogy.com to request credentials for your application.
Path Parameters
UUID of the App the subscription is tied to
UUID of the webhook subscription
Response
Secret rotated (new signing secret returned once)
A webhook subscription plus its plaintext signing secret. Returned only by create and rotate-secret; the secret cannot be retrieved again.
Unique identifier of the subscription.
Consumer endpoint the signed notification is POSTed to.
Event types this subscription receives.
active = delivering; paused = suspended by the owner; disabled = auto-disabled by the platform after repeated terminal delivery failures.
active, paused, disabled When the subscription was created.
HMAC-SHA256 signing secret (prefixed whsec_). Verify each delivery by computing
HMAC-SHA256(secret, timestampHeader + "." + rawBody) and comparing to the signature
header. Shown exactly once.