Webhooks
Rotate Signing Secret
Replaces the webhook's signing secret. Deliveries are signed with the new secret right away, so update your endpoint with it.
BearerAuthorizationBearer <op_>Workspace API key, sent as Authorization: Bearer op_... Keys are created in the dashboard.
id*string1 <= lengthIdempotency-Key?stringA unique key, such as a UUID, that makes retrying this request safe. A repeat with the same key and body within 24 hours returns the first response instead of acting again. A 429 or 5xx response is not kept, so a retry with the same key runs again.
1 <= length <= 255The webhook with its new secret. The secret is shown only in this response.
application/json- response
id*stringname*stringurl*stringurienabled*booleanfalse while the webhook is paused. A paused webhook receives no events.
events*array<string>Event types the webhook receives, as you set them. ["*"] means every event type, including ones added later.
createdAt*stringdate-timeupdatedAt*stringdate-timesecret*stringSigning secret. It is shown only here; store it now.
import { Configuration, WebhooksApi } from "@onepostly/sdk";const webhooksApi = new WebhooksApi( new Configuration({ accessToken: process.env.ONEPOSTLY_API_KEY }));const response = await webhooksApi.rotateWebhookSecret({ id: "whk_e5c7a3f18b2d4e69a04c3f9d1b7e2c58",});console.log(response);{ "id": "whk_e5c7a3f18b2d4e69a04c3f9d1b7e2c58", "name": "Production", "url": "https://example.com/hooks/onepostly", "enabled": true, "events": [ "post.published", "post.failed", "account.expired", "account.revoked" ], "createdAt": "2027-03-14T16:20:00.000Z", "updatedAt": "2027-03-15T12:00:00.000Z", "secret": "Lw4nQ8xTb2Rk7pZc1vHs9mYd3fJe6gAu"}