Rotate webhook secret

Replace a webhook’s signing secret. The previous secret keeps signing for an overlap.

POST/webhooks/{webhook}:rotate-secret

PermissionCluster key, or a scoped key with write on every collection that the webhook covers. Key scopes and actions.

The answer holds the new secret, once. The body is optional.
During the overlap each POST carries two signatures, the new one first. Deploy the new secret at any time before previous_secret_expires_at.
Use an overlap of 0 for a leaked secret. A rotation during an overlap ends the oldest secret at once.
After a 500, the rotation may have happened. Get the webhook and compare signing.secret_fingerprint before a retry.

Request

https://engine.example.com/webhooks/acme-status:rotate-secret

POST /webhooks/acme-status:rotate-secret HTTP/1.1
Host: engine.example.com
Authorization: Bearer <GRAPHON_ENGINE_API_KEY>
Content-Type: application/json

{
  "previous_secret_expires_in_seconds": 86400
}

Replace engine.example.com with your cluster host. Examples use a key placeholder.

Response

200

The webhook with its new secret, shown once. The previous secret signs until previous_secret_expires_at.

{
  "id": "whk_01K6Q6N7D8E9F0G1H2J3K4M5N6",
  "name": "acme-status",
  "scope": {
    "kind": "namespace",
    "namespaces": [
      "acme"
    ]
  },
  "url": "https://hooks.acme.example/graphon-events",
  "types": [
    "job.updated",
    "file.status_changed"
  ],
  "enabled": true,
  "disabled_reason": null,
  "signing": {
    "secret_fingerprint": "sha256:5c1e9a07",
    "previous_secret_fingerprint": "sha256:9b2d44f0",
    "previous_secret_expires_at": "2026-10-07T10:00:00Z"
  },
  "delivery": {
    "pending_deliveries": 0,
    "last_succeeded_at": "2026-10-06T10:05:13Z",
    "last_failed_at": null
  },
  "secret": "whsec_<NEW_WEBHOOK_SECRET>",
  "created_at": "2026-10-06T10:00:00Z",
  "updated_at": "2026-10-06T10:00:00Z"
}

Path parameters

webhookstringrequired

Webhook ID with the whk_ prefix, or the webhook’s name.

Request body

previous_secret_expires_in_secondsintegeroptional

How long the previous secret keeps signing, from 0 to 604,800 seconds (7 days). Default 86,400 (24 hours). 0 ends the previous secret at once.

Default: 86400

Responses

200Success

The webhook with its new secret, shown once. The previous secret signs until previous_secret_expires_at.

application/json

Response headers

x-engine-request-idstringrequired

The Engine request ID. Retain it when investigating a failed or unexpected request.

x-request-idstringrequired

The X-Request-Id you sent, echoed when it is a valid ID. Otherwise, the Engine request ID.

created_atstring (date-time)required

Time the resource was created, as an ISO 8601 UTC timestamp.

deliveryobjectrequired

Delivery summary: pending events and the times of the last success and failure.

disabled_reasonstringrequiredaccepts null

Why the webhook is off: requested (a key set enabled false) or failing (Engine turned it off). Null while it is on.

requested: A key set enabled to false.
failing: Engine turned the webhook off: the receiver answered 410, or sent no 2xx for 72 hours.

enabledbooleanrequired

Whether Engine queues and sends events.

idstringrequired

Immutable webhook ID with the whk_ prefix.

namestringrequired

Webhook name. It never changes. Each POST sends it in X-Graphon-Events-Webhook.

scopeobjectrequired

The webhook’s scope. A namespace or collection key sees only its own namespace and collections in it.

secretstringoptionalaccepts null

The signing secret: whsec_ and the base64 of 32 random bytes. Only the answers to Create and Rotate hold it. Store it before you continue.

signingobjectrequired

Fingerprints that identify the signing secrets, and the end of a rotation overlap.

typesarray<string>requiredaccepts null

Event types that the webhook gets. Null means every type, also types added later.

updated_atstring (date-time)required

Time the resource last changed, as an ISO 8601 UTC timestamp.

urlstringrequired

Receiver URL that Engine POSTs to.

Errors

Select an error in the response example to see its JSON body. See error handling for the common error format.

400invalid_request

A field, path, parameter, or conditional request rule is invalid.

What to do: Correct the request. Unknown fields are rejected.

401unauthenticated

The API key is missing, invalid, or revoked.

What to do: Send an active key in Authorization: Bearer or X-API-Key.

403forbidden

The key can see the resource but lacks permission for this operation.

What to do: Use a key with the required action or scope kind.

404not_found

The resource is absent, deleted, or outside this key’s scope.

What to do: Check the identifier and the key’s namespace and collection scope.

413request_too_large

The JSON body exceeds the route limit: 6,291,456 bytes on :answer and research, 4,194,304 bytes on :search and :read-spans, and 1,048,576 bytes elsewhere.

What to do: Reduce the JSON body. Use upload or a URI source for larger file content.

503temporarily_unavailable

A dependency, cluster readiness condition, or capacity limit prevents this operation.

What to do: Inspect retryable and details. Retry only when permitted, preserving the idempotency key for the same write.

500internal_error

An unexpected server failure prevented this request from completing.

What to do: Retain request_id for investigation. Follow retryable before retrying a write.

Was this page helpful?

View as Markdown