Rotate Webhook Signing Secret

Rotate the HMAC-SHA256 signing secret for a webhook endpoint.

POST /api/v1/widgets/webhook-endpoints/:endpointId/rotate-endpoint-secret

Generates a new signing secret for the endpoint. The old secret is immediately invalidated. Use this for key rotation or if a secret has been compromised.

Warning: The new signing secret is shown only once. Store it securely before confirming the rotation.

Parameters

Path

Name	Type	Required	Description
endpointId	string	Yes	The endpoint ID

Request example

curl --request POST 'https://payments.bleepay.com/api/v1/widgets/webhook-endpoints/wh_abc123/rotate-endpoint-secret' \
  --header 'Authorization: Bearer <business_token>' \
  --header 'Content-Type: application/json' \
  --data '{}'

Response

Response schema

Field	Type	Description
id	string	Endpoint identifier
signingSecret	string	New signing secret — shown only once

Example response

{
  "id": "wh_abc123",
  "signingSecret": "whsec_newsecret123..."
}