Skip to content
X-Buddy
Tiếng Việt

API reference

Rotate a webhook secret

webhook_rotate_secret — New signing secret, returned ONCE.

Markdown version

webhook_rotate_secret · Changes an X-Buddy setting

New signing secret, returned ONCE. For 24 hours both the new and the previous secret sign every delivery (two v1 signatures), so the receiver can switch without losing events.
REST POST /api/public/v1/webhooks/{endpoint_id}/rotate-secret
MCP tool webhook_rotate_secret
Permission needed integrations.manage — Owner, Manager
Scope group webhooks:manage
Group Events and webhooks
Shown up front in profiles Infrastructure

Input

Field Type Required Description
endpoint_id string (uuid) Yes Endpoint id.

Result

Returns the operation's result in the { data, meta } envelope.

Needs an idempotency key (Idempotency-Key, 8–128 characters). Retrying with the same key never repeats the action.

Example

Call over REST

curl -X POST "https://reach-link-craft.lovable.app/api/public/v1/webhooks/00000000-0000-4000-8000-000000000001/rotate-secret" \
  -H "Authorization: Bearer $XBUDDY_API_KEY" \
  -H "Idempotency-Key: 6f1c2a90-example-key" \
  -H "Content-Type: application/json" \
  -d '{}'

Call over MCP

{
  "method": "tools/call",
  "params": {
    "name": "webhook_rotate_secret",
    "arguments": {
      "endpoint_id": "00000000-0000-4000-8000-000000000001",
      "idempotency_key": "6f1c2a90-example-key"
    }
  }
}

Errors you may get

Code HTTP Retryable
unauthorized 401 No
key_expired 401 No
integration_revoked 401 No
connection_not_linked 403 No
integration_paused 403 No
workspace_integrations_paused 403 No
integration_authorization_lost 403 No
workspace_suspended 403 No
forbidden 403 No
invalid_input 422 No
rate_limited 429 Yes
internal 500 Yes
read_only 403 No
idempotency_key_required 428 No
idempotency_conflict 409 No
idempotency_processing 409 Yes
conflict 409 No
precondition_failed 422 No
not_found 404 No

Back to all operations