Rotate a webhook connection's signing secret

Generates a new signing secret for the connection and returns it once. The previous secret stops validating immediately, so update the receiver before rotating in production.

POST /v1/projects/{projectId}/webhooks/connections/{id}/secret/rotate

cURL

cURL

curl -X POST \
  -H "X-API-Key: $PARTICLE_API_KEY" \
  "https://api.particle.pro/v1/projects/{projectId}/webhooks/connections/{id}/secret/rotate"

200

{
  "created_at": "2023-11-07T05:31:56Z",
  "id": "<string>",
  "project_id": "<string>",
  "secret": "<string>",
  "secret_prefix": "<string>",
  "surface": "PLATFORM",
  "url": "<string>",
  "created_by": {
    "id": "<string>",
    "name": "<string>"
  },
  "name": "<string>",
  "revoked_at": "2023-11-07T05:31:56Z"
}

Authorizations

ApiKeyHeaderBearerAuth

X-API-Key · string · header · required

Pass your API key in the X-API-Key header (recommended).

Path Parameters

projectId · string · required

Project ID (base62-encoded).

id · string · required

Webhook connection ID (base62-encoded).

Response

200

application/json

OK

created_at · string<date-time> · required

id · string · required

project_id · string · required

secret · string · required

Signing secret — shown only at create/rotate time. Store it securely; it cannot be retrieved again. Used to verify the X-Webhook-Signature header on delivered payloads.

secret_prefix · string · required

Masked signing-secret prefix for identification. The full secret is shown only at create/rotate time and cannot be retrieved afterward.

surface · enum<string> · required

Which Particle surface created this connection. Fixed at create time and inferred from the caller's authenticated surface context. Provenance only — an alert on either surface can deliver through it. Render it to show where the endpoint was registered.

Available options: PLATFORM, RADAR

url · string · required

Destination URL that signed POSTs are delivered to.

created_by · object

User who created the connection. Null when created via an API key.

Show child attributes

name · string

Optional human label for the connection.

revoked_at · string<date-time>

Set when the connection was deleted/revoked; absent for active connections. A revoked connection stops delivering and is skipped by alerts that still reference it.