Skip to main content
POST
Rotate Webhook Secret

Authorizations

Authorization
string
header
required

API key in the Authorization header: Bearer qr_live_… or Bearer qr_test_…. Token endpoints take a Clerk session JWT instead.

Path Parameters

id
string
required

Response

Endpoint with new secret (full value shown once)

id
string
Example:

"whe_aB3dE5fG7hI9jK1m"

object
string
Example:

"webhook_endpoint"

url
string<uri>
Example:

"https://example.com/webhooks/qrkit"

description
string | null
events
string[]
Example:
source
enum<string>

Who manages this endpoint. Set at creation, immutable afterwards. Endpoint caps are counted per source.

Available options:
api,
zapier,
make,
n8n
status
enum<string>

auto_disabled is set automatically after sustained delivery failures. Re-enable with PATCH /webhooks/{id} { "status": "enabled" }.

Available options:
enabled,
disabled,
auto_disabled
secret
string

Full whsec_… value returned only on create (POST /webhooks) and secret rotation (POST /webhooks/{id}/rotate-secret). All other reads return the masked form whsec_…XXXX.

Example:

"whsec_…a1b2"

last_success_at
string<date-time> | null
last_failure_at
string<date-time> | null
created_at
string<date-time>
updated_at
string<date-time>