Skip to navigation
API ReferenceWebhooks

Rotate a signing secret

Available by request

Webhooks are only available for certain clients. Contact your Rush Order representative to have them enabled. Creating or changing subscriptions with an API key must also be enabled for your account; otherwise this returns 403.

Issues a new signing secret and returns it. This is the only time it is shown. For 15 minutes afterward, each delivery carries signatures from both the new and the previous secret, so you can deploy the new secret without rejecting deliveries. If the previous secret may be compromised, send {"RevokeImmediately": true} to stop signing with it straight away; deliveries will then fail your signature check until the new secret is deployed. The body is optional.

Authentication

AuthorizationBasic

Basic authentication of the form Basic <base64(username:password)>.

Path parameters

idintegerRequired
The subscription ID.

Headers

RushOrderMomCodestringRequired
All requests require the header to contain RushOrderMomCode, a 3 character string that represents the client internally in Rush Order. This should be given to you by Rush Order.

Request

This endpoint expects an object.
RevokeImmediatelybooleanOptional
Stop signing with every previous secret right away. Defaults to false.

Response

Success
SubscriptionIdintegerOptional
SecretstringOptional

The signing secret, beginning with whsec_. This is the only time it is returned, so store it right away.

PreviousSecretExpiresAtdatetime or nullOptional
When the previous secret stops signing deliveries. Null on create, and null when the previous secret was revoked immediately.

Errors

403
Forbidden Error
404
Not Found Error