API reference / Webhooks

post/v2/webhook-endpoints/{id}/rotate-secret

Rotate the signing secret

Operation
rotateWebhookSecret
Authentication
API key

Returns a new secret. **The previous one stops working immediately** — there is no overlap window, so deploy the new secret before rotating or deliveries will be rejected in the meantime.

Request

Parameters

idpathrequiredstring

Responses

200Rotated.
endpointWebhookEndpointrequired
secretstringrequired

The HMAC signing secret. Unlike an API key this is recoverable — we sign every delivery with it — but a partner who never sees it cannot verify anything we send.

warningstringrequired
400The request body or query failed validation.
errorobjectrequired
401No key, an unknown key, a revoked key, or a key whose tenant is not active. All four return an identical body on purpose: distinguishing them would let a caller discover which partners we have.
errorobjectrequired
403The key is valid but lacks the scope, or it asked for a scope it does not itself hold.
errorobjectrequired
404Not found, or not yours. A resource belonging to another tenant answers 404 rather than 403, because 403 would confirm the record exists.
errorobjectrequired

Example

curl
curl -X POST https://api.haavisa.com/v2/webhook-endpoints/<id>/rotate-secret \
  -H "Authorization: Bearer $HAAVISA_API_KEY"

More in Webhooks

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.