Rotate secret
Replaces the endpoint's signing secret.
Generates a new secret for the endpoint and returns it in the response, only once. The old secret stops working at once: the next delivery, including pending retries, is signed with the new one.
Use it when the secret leaks or gets lost. Update your system right after: until then, signatures will not match. A delivery already on its way at the moment of the swap may arrive with the old signature.
The dashboard has the same button, Rotate secret, on the endpoint page.
api_keyAuthorizationBearer <token>API key (mk_...)
id*stringIdentifier of the resource, as returned by the API.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidIdempotency-Key?stringOptional. A unique value (for example a UUID), 1 to 255 characters, that makes the request safe to retry: repeating it with the same body within 24h returns the original response with Idempotency-Replayed: true instead of running the operation again. Scoped to your account. Reusing it with a different body returns 409.
1 <= length <= 255The secret was replaced. The body carries the new secret, which shows up only here. The old one no longer works.
application/json- response
The endpoint, with its signing secret.
id*stringOpaque unique identifier of the endpoint, generated by the API. Use it in the /v1/webhooks/endpoints/{id} routes and to filter deliveries.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidurl*stringWhere we send the events, with a POST.
description*|Your note about the endpoint. null when there is none.
events*array<|>Event types the endpoint receives, or ["*"] for every type, including future ones.
enabled*booleanfalse pauses the endpoint: new events skip it, and its pending deliveries fail without a call.
createdAt*stringWhen the endpoint was created, in ISO-8601 (UTC).
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timeupdatedAt*stringWhen the endpoint last changed, in ISO-8601 (UTC).
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timesecret*stringSecret to verify the signature of every delivery (X-Marketapi-Signature). It shows up only in this response (creation or rotation): keep it.
curl -X POST "https://example.com/v1/webhooks/endpoints/3d1c8a52-7f0e-4b0a-8a65-9c1b2f6d7e01/rotate-secret"{ "id": "c2d3e4f5-a6b7-4c8d-9e0f-1a2b3c4d5e6f", "url": "https://your-app.com/webhooks/marketapi", "description": "Production", "events": [ "*" ], "enabled": true, "createdAt": "2026-10-06T14:20:00.000Z", "updatedAt": "2026-10-06T14:20:00.000Z", "secret": "whsec_4fJ9kL2mN7pQ1rS8tU3vW6xY0zA5bC4dE9fG2hJ7kLm"}