Rotate the signing secret
Makes a new secret. For overlap_hours (24 unless set) every request carries two signatures, one per secret, so a receiver verifying with either keeps working while you update it. Then only the new secret signs.
api_key webhooksAuthorizationBearer <token>A team API key, made by an admin under Settings, API keys. Send it as Authorization: Bearer chk_....
Scope: webhooks
endpoint_id*stringThe endpoint's id.
application/json- body
How long the old secret keeps signing.
overlap_hours?|Hours the old secret keeps signing beside the new one: 0 to 168. Defaults to 24. With 0 the old secret stops at once.
int6424The new secret, shown once here.
application/json- response
A rotated secret.
previous_secret_expires_at?|Until then, requests carry a second signature made with the old one.
"2026-10-27T09:00:00Z"secret*stringThe new secret. Requests are signed with it from now on.
"whsec_k0q8vX2mZp5Rr3t1YbN6cH9dLwE4fJ7aS1uG0iT2oQs="curl -X POST 'https://api.coderhelm.com/api/webhooks/endpoints/ep_01jbendpt4a7b0c3d6e9f2g5h8/secret/rotate' \ -H "Authorization: Bearer $CODERHELM_API_KEY" \ -H 'Content-Type: application/json' \ -d '{}'{ "previous_secret_expires_at": "2026-10-27T09:00:00Z", "secret": "whsec_k0q8vX2mZp5Rr3t1YbN6cH9dLwE4fJ7aS1uG0iT2oQs="}Reveal the signing secret GET
The endpoint's current signing secret. Each reveal is written to the team's audit log.
Send a test event POST
Sends one `webhook.test` event to the endpoint now, signed like every other event, and answers with the attempt. A test is tried once (no retries) and is sent even when the endpoint is off or doesn't subscribe to it.