Rotate webhook signing secret

Issue a new signing secret and return it. The previous secret keeps signing alongside it for 24 hours, so deliveries stay verifiable while you roll the new value out; during that window webhook-signature carries both values, space delimited, and a receiver accepts whichever matches. Rotate immediately if a secret leaks.

POSThttps://api.omnifence.ai/api/v1/me/webhook-secrets/rotate

Issues a new signing secret and returns it. The previous secret keeps signing alongside it for 24 hours, so deliveries stay verifiable while you roll the new value out.

During that window webhook-signature carries both values, space delimited, and a Standard Webhooks library accepts whichever one matches. Split the header on spaces — the comma belongs inside each v1,<base64> value.

Rotate immediately if a secret leaks. See rotating the secret.

These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Request#

Headers#

Name	Type	Required	Description
`Authorization`	string	Yes	Your API key as a Bearer token: `Bearer YOUR_API_KEY`.

Responses#

200 OK#

Field	Type	Always present	Description
`secret`	string	Yes
`secrets`	array of object	Yes
`secrets[].id`	string	Yes
`secrets[].created_at`	string (date-time)	Yes
`secrets[].expires_at`	null or string (date-time)	Yes
`secrets[].status`	string	Yes	One of `active`, `expiring`.

Example responseJSON

{
  "secret": "string",
  "secrets": [
    {
      "id": "string",
      "created_at": "2026-05-19T12:00:00.000Z",
      "expires_at": "2026-05-19T12:00:00.000Z",
      "status": "active"
    }
  ]
}