Rotate Webhook Secret
Generates a new signing secret for the endpoint and returns it (full value,
shown once). The previous secret remains valid as a second v1= signature
entry for 24 hours to allow zero-downtime rotation.
Requires the webhooks:write scope.
Authorizations
API key in the Authorization header: Bearer qr_live_… or Bearer qr_test_…. Token endpoints take a Clerk session JWT instead.
Path Parameters
Response
Endpoint with new secret (full value shown once)
"whe_aB3dE5fG7hI9jK1m"
"webhook_endpoint"
"https://example.com/webhooks/qrkit"
Who manages this endpoint. Set at creation, immutable afterwards. Endpoint caps are counted per source.
api, zapier, make, n8n auto_disabled is set automatically after sustained delivery failures. Re-enable with PATCH /webhooks/{id} { "status": "enabled" }.
enabled, disabled, auto_disabled Full whsec_… value returned only on create (POST /webhooks) and secret rotation (POST /webhooks/{id}/rotate-secret). All other reads return the masked form whsec_…XXXX.
"whsec_…a1b2"

