Openapi
Replace the signing secret of an incoming webhook endpoint and keep its URL. During the grace window the previous secret still verifies deliveries. The new secret is returned only once.
sb-auth-token<token>Supabase browser session cookie. Supabase may split larger session values into chunked cookies like sb-auth-token.0.
endpointId*stringuuidorganizationId*stringuuidHours the previous secret keeps verifying deliveries, 0 to stop it at once.
application/jsongraceHours*integer0 <= value <= 1680Returns the endpoint with its new one-time signing secret and the end of the grace window.
application/jsoncreatedAt*dateTimeSchemacreatedBy*|uuidenabled*booleanid*stringuuidlastReceivedAt*dateTimeSchema|nulllastStatus*integer|nullmaxBodyBytes*integer0 < valuename*string1 <= lengthorganizationId*organizationIdSchemauuidreceiveCount*integer0 <= valuesignatureHeader*string|nullverify*webhookEndpointVerifySchema"standard-webhooks""hmac-sha256""shared-secret""none"workflowDefinitionId*|uuidpreviousSecretExpiresAt*dateTimeSchema|nullsecret*string16 <= length <= 200curl -X POST 'https://app.localhost/api/v1/organizations/123/webhooks/endpoints/123e4567-e89b-12d3-a456-426614174000/rotate-secret' \ -H 'Content-Type: application/json' \ -d '{ "graceHours": 0}'{ "createdAt": "string", "createdBy": "25a02396-1048-48f9-bf93-102d2fb7895e", "enabled": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "lastReceivedAt": "string", "lastStatus": 0, "maxBodyBytes": 1, "name": "string", "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9", "receiveCount": 0, "signatureHeader": "string", "verify": "standard-webhooks", "workflowDefinitionId": "1807650c-92d5-478c-9be3-f7718df99efb", "previousSecretExpiresAt": "string", "secret": "stringstringstri"}