Rotate an endpoint's signing secret

POST

/v1/webhook-endpoints/{webhook_endpoint_id}/rotate-secret

const { secret, previous_secret_expires_at } = await gp.webhookEndpoints.rotateSecret('whe_…', {
  previous_secret_ttl_hours: 24,
});

• GRYPHEM PAY API

The previous secret stays valid for previous_secret_ttl_hours (0–168, default 24); meanwhile deliveries carry one v1 signature per valid secret.

Authorizations

• ApiKey
• Session

Parameters

Path Parameters

webhook_endpoint_id

required

string

Header Parameters

Gryphem-Organization

string

Active organization for dashboard sessions. Ignored for API keys (the key determines the organization).

Request Body

Media typeapplication/json

object

previous_secret_ttl_hours

integer

default: 24 <= 168

Responses

200

New secret (shown once). The previous secret keeps signing in parallel until it expires.

Media typeapplication/json

object

endpoint_id

required

string

secret

required

string

previous_secret_expires_at

required

string | null format: date-time

Example ^generated

{
  "endpoint_id": "example",
  "secret": "example",
  "previous_secret_expires_at": "2026-04-15T12:00:00Z"
}

401

Missing or invalid credentials.

Media typeapplication/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found_error conflict_error idempotency_error rate_limit_error feature_unavailable_error api_error

code

required

string

message

required

string

param

string

request_id

required

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

403

Authenticated but not permitted.

Media typeapplication/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found_error conflict_error idempotency_error rate_limit_error feature_unavailable_error api_error

code

required

string

message

required

string

param

string

request_id

required

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

404

Resource not found (or not visible to this tenant).

Media typeapplication/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found_error conflict_error idempotency_error rate_limit_error feature_unavailable_error api_error

code

required

string

message

required

string

param

string

request_id

required

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

422

Validation failed.

Media typeapplication/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found_error conflict_error idempotency_error rate_limit_error feature_unavailable_error api_error

code

required

string

message

required

string

param

string

request_id

required

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

429

Too many requests. See Retry-After.

Media typeapplication/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found_error conflict_error idempotency_error rate_limit_error feature_unavailable_error api_error

code

required

string

message

required

string

param

string

request_id

required

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

Headers

Retry-After

integer