Rotate a webhook secret

POST/v1/workspaces/{workspaceId}/webhooks/{webhookId}/rotate-secret

Makes a new signing secret and shows it once. The previous secret keeps signing for the overlap, 24 hours by default. A member manages their own webhooks, a workspace key manages workspace webhooks, and an Admin manages every webhook.

View as Markdown

Authentication

Send your Graphon API key with every request. The value is the whole API key that Graphon showed when you created it. See Authentication.

Authorization: Bearer <GRAPHON_API_KEY>

curl \
  --url "https://api.beta.graphon.ai/v1/workspaces/wspq7ws2np5l8z4/webhooks/whkN4vB7qX2mZ/rotate-secret" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"previousSecretExpiresInSeconds":86400}'

Request

Loading your session…

Response

JSON

{
  "webhook": {
    "id": "whkN4vB7qX2mZ",
    "workspaceId": "wspq7ws2np5l8z4",
    "name": "indexing-callbacks",
    "url": "https://hooks.example.com/graphon",
    "eventTypes": [
      "object.indexed",
      "object.indexing_failed"
    ],
    "bucketIds": null,
    "enabled": true,
    "disabledReason": null,
    "ownerKind": "user",
    "ownerUserId": "usrB2c3D4e5F6",
    "signing": {
      "secretFingerprint": "sha256:9b2d44f0",
      "previousSecretFingerprint": null,
      "previousSecretExpiresAt": null
    },
    "delivery": {
      "pendingDeliveries": 0,
      "lastSucceededAt": "2026-10-14T09:05:13.004Z",
      "lastFailedAt": null
    },
    "createdBy": {
      "userId": "usrB2c3D4e5F6",
      "apiKeyId": null
    },
    "createdAt": "2026-10-14T09:00:00.000Z",
    "updatedAt": "2026-10-14T09:00:00.000Z"
  },
  "secret": "whsec_<shown once>"
}

Path parameters

workspaceIdstring

The workspace id.

webhookIdstring

The webhook id.

Request body

previousSecretExpiresInSecondsnumber (optional)

How long the previous secret keeps signing: 0 to 604800 (7 days). Default 86400. 0 stops it at once.

Was this page helpful?