Rotate the signing secret

POSThttps://api.checkslip.com/api/webhooks/endpoints/{endpoint_id}/secret/rotate

API key

Issues a new secret, shown only in this response. The old secret keeps working for 24 hours (see previous_secret_expires_at); meanwhile every message carries both signatures in the webhook-signature header, separated by a space, so you can switch your system to the new secret without missing a message. You cannot rotate again within those 24 hours (ROTATION_IN_PROGRESS). An Idempotency-Key is required. The account owner gets an email, which never contains the secret. Needs an API key with webhook:manage.

Parameters

Field	In	Type	Required
`endpoint_id`	path	`string`	yes
`traceparent`	header	`string`	no
`Idempotency-Key`	header	`string`	yes

Responses

200 `application/json`

Field	Type	Required
`secret`	`string`	yes
`previous_secret_expires_at`	`string (date-time)`	yes

Possible errors

400401403404409422

An error as Problem Details. All codes are listed at Error codes

curl -X POST https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate \
  -H "Authorization: Bearer $CHECKSLIP_API_KEY" \
  -H "Idempotency-Key: order-1042-slip-1"

const res = await fetch("https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CHECKSLIP_API_KEY}`,
    "Idempotency-Key": "order-1042-slip-1",
  },
});
const data = await res.json();

import os

import requests

res = requests.post(
    "https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate",
    headers={
        "Authorization": f"Bearer {os.environ['CHECKSLIP_API_KEY']}",
        "Idempotency-Key": "order-1042-slip-1",
    },
)
data = res.json()

Example response

{
  "secret": "string",
  "previous_secret_expires_at": "2026-11-05T09:30:00+07:00"
}

Parameters#

Responses#

200 application/json#

Possible errors#

Parameters

Responses

200 `application/json`

Possible errors