Rotate a webhook secret

Makes a new signing secret and shows it once. The previous secret keeps signing for the overlap, 24 hours by default. A member manages their own webhooks, a workspace key manages workspace webhooks, and an Admin manages every webhook.

POST/v1/workspaces/{workspaceId}/webhooks/{webhookId}/rotate-secret

Authentication

Send your Graphon API key with every request. The value is the whole API key that Graphon showed when you created it. See Authentication.

Authorization: Bearer <GRAPHON_API_KEY>

curl \
  --url "https://api.graphon.ai/v1/workspaces/wspq7ws2np5l8z4/webhooks/whkN4vB7qX2mZ/rotate-secret" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"previousSecretExpiresInSeconds":86400}'

Request

Loading your session…

Response

JSON

{
  "webhook": {
    "id": "whkN4vB7qX2mZ",
    "workspaceId": "wspq7ws2np5l8z4",
    "name": "indexing-callbacks",
    "url": "https://hooks.example.com/graphon",
    "eventTypes": [
      "object.indexed",
      "object.indexing_failed"
    ],
    "bucketIds": null,
    "enabled": true,
    "disabledReason": null,
    "ownerKind": "user",
    "ownerUserId": "usrB2c3D4e5F6",
    "signing": {
      "secretFingerprint": "sha256:9b2d44f0",
      "previousSecretFingerprint": null,
      "previousSecretExpiresAt": null
    },
    "delivery": {
      "pendingDeliveries": 0,
      "lastSucceededAt": "2026-10-14T09:05:13.004Z",
      "lastFailedAt": null
    },
    "createdBy": {
      "userId": "usrB2c3D4e5F6",
      "apiKeyId": null
    },
    "createdAt": "2026-10-14T09:00:00.000Z",
    "updatedAt": "2026-10-14T09:00:00.000Z"
  },
  "secret": "whsec_<shown once>"
}

Path parameters

workspaceIdstring

The workspace id.

webhookIdstring

The webhook id.

Request body

previousSecretExpiresInSecondsnumber (optional)

How long the previous secret keeps signing: 0 to 604800 (7 days). Default 86400. 0 stops it at once.

Was this page helpful?

View as Markdown