POST /v1/webhooks/{webhookId}/rotate-secret
Rotate a receiver's signing secret
Replaces the receiver's signing secret and answers the new one. This signing secret is shown once, in this answer, and never again: store it now, like a password. If you lose it, rotate it (POST /v1/webhooks/{webhookId}/rotate-secret). The old secret stops verifying from the next delivery attempt, retries of earlier events included, so switch your receiver to the new secret at once. Needs a key with the order-intake capability. Free.
| Key | Required. See Authentication. |
|---|---|
| Capability | order-intake |
| Scope | orders.webhooks |
| Price | free. How pricing works. |
Example
curl -s -X POST "https://api.compudime.com/v1/webhooks/{webhookId}/rotate-secret" \
-H "Authorization: Bearer $PUBLIC_API_KEY"Parameters
| Name | In | Type | Description |
|---|---|---|---|
webhookId required | path | string | The receiver's id (id in the answer of POST /v1/webhooks or GET /v1/webhooks). An id your key has no receiver under is 404 webhook_not_found. |
Responses
| Status | Description | Body |
|---|---|---|
200 | The secret is replaced; the new secret is shown in this answer only. | WebhookSecretResponse |
401 | Public API key is missing, invalid, or revoked. | Problem |
403 | The API key does not carry the order-intake capability, or the store has not turned it on (code capability_not_enabled). | Problem |
404 | Your key has no receiver with this id: it never existed, belongs to another integration or to a key of the other mode, or you removed it (code webhook_not_found). | Problem |
405 | The requested method is not allowed for this endpoint. | Problem |
429 | Too many requests from this API key (code rate_limited). Each key has its own request budget at the API edge, refilled continuously; it covers every authenticated endpoint, including the free ones, and is checked before anything is billed or sent to the store. Wait at least Retry-After seconds before the next request with this key, then resume; if 429 answers again, back off exponentially (double the wait each time, up to a minute or so) and add random jitter so parallel workers do not retry in step. A 429 is never charged and reserves nothing. Header Retry-After: Whole seconds to wait before retrying with this key: the time until the key's next request token at the edge (never less than 1), or 60 when the store plan's per-minute ceiling refused the call. | Problem |
500 | The API edge encountered an internal error. | Problem |
503 | A required Public API dependency is temporarily unavailable. Also answered, with code endpoint_disabled, while CompuDime has temporarily switched the endpoint off: the whole API, the endpoint's family (x-compudime-family) or this endpoint alone; the detail says which and why. It is checked before anything is validated, reserved or sent to the store, so it is never charged; it is retryable and carries Retry-After. Header Retry-After: Sent with code endpoint_disabled: whole seconds to wait before asking again. A switch has no scheduled end, so this is a polling interval (60), not a promise. | Problem |
Error bodies are problem JSON; every code is listed there.
Access level
What your integration's access level changes here.
| Level | Scope | Effect |
|---|---|---|
own | orders.webhooks | The level does not change this operation: own and all return the same data. |
all | orders.webhooks | The level does not change this operation: own and all return the same data. |