Skip to main content
POST
Rotate the webhook signing secret
Issues a new signing secret and returns it. The previous secret keeps signing alongside it for 24 hours, so deliveries stay verifiable while you roll the new value out. During that window webhook-signature carries both values, space delimited, and a Standard Webhooks library accepts whichever one matches. Split the header on spaces — the comma belongs inside each v1,<base64> value. Rotate immediately if a secret leaks. See rotating the secret.
These endpoints need the webhook:manage scope. Your dashboard session carries it, so Account → Webhooks always works. An API key does not carry it by default — a key that only moderates content must not be able to read the credential that proves a callback came from us. Contact support if you need it on a key.

Authorizations

Authorization
string
header
required

API key from the Omnifence dashboard

Response

200 - application/json

Default Response

secret
string
required
secrets
object[]
required