rotateWebhookEndpointSecret

Requires permission settings:webhooks:update.

Issues a new signing secret for a webhook endpoint and returns it once. The old secret stops verifying immediately. Requires permission to update webhooks.

Errors: a failed call returns a GraphQL errors entry, not a field on the result, and data may be null or partial. Read the entry's extensions.code and message; every shape and code is in the Error reference.

Example:

GraphQL

mutation RotateWebhookEndpointSecret($id: ID!) {
  rotateWebhookEndpointSecret(id: $id) {
    secret
    endpoint {
      id
      name
      createdAt
      eventTypes
      isActive
      secretHint
    }
  }
}

cURL

curl -X POST "https://<api-host>/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data @- <<'EOF'
{
  "query": "mutation RotateWebhookEndpointSecret($id: ID!) {\n  rotateWebhookEndpointSecret(id: $id) {\n    secret\n    endpoint {\n      id\n      name\n      createdAt\n      eventTypes\n      isActive\n      secretHint\n    }\n  }\n}",
  "variables": {
    "id": "id"
  }
}
EOF

Variables:

{
  "id": "id"
}

Response:

{
  "data": {
    "rotateWebhookEndpointSecret": {
      "secret": "string",
      "endpoint": {
        "id": "id",
        "name": "string",
        "createdAt": "2025-01-15T00:00:00Z",
        "eventTypes": [
          "string"
        ],
        "isActive": true,
        "secretHint": "string"
      }
    }
  }
}

rotateWebhookEndpointSecret(
  id: ID!
): WebhookEndpointWithSecret!

Arguments

rotateWebhookEndpointSecret.id ● ID! non-null scalar

The ID of the webhook endpoint.

Type

WebhookEndpointWithSecret object

A webhook endpoint with its signing secret. It is returned only when the endpoint is created or its secret is rotated, and cannot be read again.