Rotate Signing Secret

POSThttps://public.leadpattern.com/v2/webhook/:webhookId/rotate-secret

Plan: webhooksapplication/json60 req/min

Generate a new signing secret for a webhook. The new secret is returned once in data.secret — store it immediately. If the webhook already had a secret, the old one stays valid for 24 hours (until data.previousSecretValidUntil): during that window every delivery carries signatures made with both secrets — X-Webhook-Signature / X-Webhook-Signature-V2 (new) and X-Webhook-Signature-Previous / X-Webhook-Signature-V2-Previous (old) — so you can switch your receiver over without dropping deliveries. Calling it on an unsigned webhook turns signing on (no grace period, previousSecretValidUntil: null).

For 24 hours after a rotation, every delivery carries X-Webhook-Signature / X-Webhook-Signature-V2 (new secret) and X-Webhook-Signature-Previous / X-Webhook-Signature-V2-Previous (old secret). Accept a match on either until your receiver uses the new secret.
Setting your own secret (Edit Webhook: secret) or removing it (removeSecret: true) ends the grace period immediately.

Headers

1 field

Authorizationstring

required

Your API key. Sent raw (e.g. 'lp_...'). No Bearer prefix required.

Path Parameters

1 field

webhookIdstring

required

Webhook ID.

Responses

JSON Response

{
  "type": "success",
  "data": {
    "secret": "whsec_9d41e7…",
    "previousSecretValidUntil": "2026-07-02T10:30:00.000Z",
    "secretRotatedAt": "2026-07-01T10:30:00.000Z"
  }
}

Sample Request Body

{
  "webhookId": "664abc123def456789012345 (path parameter)"
}