Rotate the signing secret
Replace the signing secret with a new one.
https://app.usenotix.dev/api/v1/webhooks/{webhookId}/rotate-secretNeeds a full access key. Sending access keys cannot call this. Key permissions lists the extra rules some calls have.
Replace the signing secret with a new one. The answer is the only time Notix shows the new secret. The old secret stops working at once, so update your endpoint straight away. A team can rotate 10 secrets a minute.
Who can call it
A full access key created by a team admin, as on the dashboard. Every refusal is 403:
| Code | Why |
|---|---|
SCOPE_DENIED | The key is not a full access key (send-only, read-only or live AI). |
DOMAIN_PINNED | The key is limited to one domain. A webhook receives the events of every domain. |
FORBIDDEN | The key was made by a team member without admin rights, or before Notix recorded who made each key. Create a new key as a team admin. |
Adding a webhook, pointing one at a new URL or removing one emails the team's owner and admins, naming the key.
Path parameters
Headers
Bearer followed by your API key.
Errors
`SCOPE_DENIED`: the key is not a full access key (send-only, read-only or live AI). `DOMAIN_PINNED`: the key is limited to one domain. `FORBIDDEN`: the key was made by a team member without admin rights, or before Notix recorded who made each key (create a new key).
No webhook with this id for the calling team.
The team rotated 10 secrets in the last minute.
Every error has the same shape. See all error codes.
curl -X POST "https://app.usenotix.dev/api/v1/webhooks/<webhookId>/rotate-secret" \
-H "Authorization: Bearer $NOTIX_API_KEY"
import { Notix } from "notix-js";
const notix = new Notix(process.env.NOTIX_API_KEY);
const { data, error } = await notix.webhookEndpoints.rotateSecret("wh_123");
// The old secret stops working now: update your app with data.secret.
{
"id": "cm1x8f3k20001qz7v5b9d2e4a",
"url": "string",
"description": "string",
"status": "ACTIVE",
"eventTypes": [
"string"
],
"domainIds": [
1
],
"apiVersion": "string",
"consecutiveFailures": 1,
"lastFailureAt": "string",
"lastSuccessAt": "string",
"secretHint": "whsec_••••••••••••••••••••••••",
"createdAt": "string",
"updatedAt": "string",
"secret": "whsec_3f9c…"
}