Rotate webhook subscription signing secret

Rotate the HMAC signing secret for one subscription (new secret returned once).

POST/api/webhook-subscriptions/{subscription_id}/rotate-secret

Scope webhooks:writeUpdated September 27, 2026

This page documents the canonical HTTP contract. Switch to the CLI example when you want the operator workflow.

Replaces the HMAC secret used by subsequent delivery attempts. The new full secret is returned once. Delivery records use their snapshotted URL and retry settings, while workers load the current subscription secret when sending.

Path parameters

subscription_idrequired
string
Subscription ID.

Name	Type	Description
subscription_idrequired	string	Subscription ID.

Errors

Status	Meaning
401	Invalid API key or missing auth.
403	Missing webhooks:write scope.
404	Subscription not found.

Example

bash

curl -X POST "https://app.autotouch.ai/api/webhook-subscriptions/67c88a24b4dd8f2d4999f912/rotate-secret" \
    -H "Authorization: Bearer stk_your_key_id.your_secret"

Response example

json

{
    "success": true,
    "subscription": {
      "id": "67c88a24b4dd8f2d4999f912",
      "signing_secret": "stwhsec_...returned_once...",
      "signing_secret_last4": "p9X1"
    }
  }