API Reference

Rotate Webhook Secret

POST /webhooks/:id/rotate — replace the signing secret for a webhook.

POST/webhooks/:id/rotate

Rotates the signing secret for a webhook, invalidating the old secret immediately. Use this if your current secret has been compromised or as part of a regular credential rotation policy. The new plaintext secret is returned once in this response — store it securely before the request completes.

Path parameters

idstringrequired

The webhook id as returned by Create Webhook or List Webhooks — a numeric string (e.g. 17), not a UUID. A non-numeric id returns not_found (404).

import { Mailblastr } from 'mailblastr';

const mb = new Mailblastr('mb_xxxxxxxxx');

const { data, error } = await mb.webhooks.rotate('17');
console.log({ data, error });

Response

{
  "object": "webhook",
  "id": "17",
  "signing_secret": "whsec_xxxxxxxxxx"
}

The new signing_secret is only returned here, at rotation. The old secret stops working immediately. Store the new value securely — it cannot be retrieved again.