Roll the signing secret
Replaces the secret immediately; every delivery from now on is signed with the new one. Update your server to check it. Needs step-up.
Error codes: invalid_api_key, parameter_invalid, resource_not_found, scope_missing, step_up_required, csrf_token_invalid, idempotency_key_reused, rate_limited.
Authorizations
Server API key, scoped. pk_test_ keys hit the sandbox tenant.
Headers
Proof of a 2FA step-up within the last 5 minutes (POST /v1/auth/step-up).
Optional on non-money POSTs; honoured when sent.
1 - 255Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always
our own req_… id. We log your value with the request as client_request_id, so support can find a request by
either id. A longer value is refused with 400 parameter_invalid.
128Path Parameters
Webhook endpoint id.
^whe_[0-9A-HJKMNP-TV-Z]{26}$Response
The new secret.
The current signing secret.
Always webhook_secret.
"webhook_secret"Endpoint.
^whe_[0-9A-HJKMNP-TV-Z]{26}$whsec_….
^whsec_[A-Za-z0-9]{24,}$When this secret was created (endpoint creation or last roll).
"2026-10-27T08:41:00Z"