Rotate the signing secret

POSThttps://api.norreach.app/v1/webhook-endpoints/{id}/rotate-secret

A new signing secret, shown once. For 24 hours deliveries carry a signature with the old secret too, so you can switch without missing events.

webhooks:writeRole must allow: api.keysOperation id: rotate_webhook_secret

POST/webhook-endpoints/{id}/rotate-secret

curl -X POST "https://api.norreach.app/v1/webhook-endpoints/{id}/rotate-secret" \
  -H "Authorization: Bearer $NORREACH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Rotate the signing secret

{
  "id": "0f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
  "object": "webhook_endpoint",
  "url": "https://hooks.example.com/norreach",
  "description": "CRM sync",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ],
  "status": "active",
  "include_content": false,
  "disabled_reason": null,
  "created_by": "0b6f8a52-8d9e-4c1a-b7f3-5e2d9c4a1b00",
  "created_via_key": true,
  "previous_secret_valid_until": "2026-11-05T09:12:33.120Z",
  "created_at": "2026-11-04T09:12:33.120Z",
  "updated_at": "2026-11-04T09:12:33.120Z",
  "secret": "whsec_k3…"
}

Authorizations

Authorizationstringheaderrequired

Bearer authentication: send Authorization: Bearer <key>, with an API key or an OAuth access token. The key needs the scope webhooks:write. API keys and scopes

Path parameters

idstring (uuid)pathrequired

An id (UUID).

Headers

Idempotency-Keystringheader

Any unique string (≤ 255). The same key with the same request returns the first answer for 24 hours.

Response

200application/json— Rotate the signing secret

idstring (uuid)required

An id (UUID).

object"webhook_endpoint"required

urlstringrequired

descriptionstring | nullrequired

event_typesstring[]required

statusenumrequired

paused = the person who made it left; an admin takes it over in Settings.

One of:activedisabledpaused

include_contentbooleanrequired

Message events carry the subject and text.

disabled_reasonstring | nullrequired

by_user, gone (the endpoint answered 410), failing, creator_inactive.

created_bystring (uuid) | nullrequired

created_via_keybooleanrequired

previous_secret_valid_untilstring | nullrequired

After a rotation the old secret also signs until then.

created_atstringrequired

RFC 3339 UTC timestamp with milliseconds.

updated_atstringrequired

RFC 3339 UTC timestamp with milliseconds.

secretstringrequired

The signing secret — shown only now. Store it; NorReach keeps only an encrypted copy.

Errors

Errors are application/problem+json with a stable code.

Status	Code	Meaning
400	`bad_request`	The request couldn't be read.
400	`unknown_field`	The request has a field this operation doesn't know.
401	`unauthorized`	A valid API key is required.
403	`insufficient_scope`	This API key doesn't have the scope this operation needs.
403	`feature_not_enabled`	The API isn't switched on for this workspace.
403	`role_forbidden`	The key's creator's role can't do this.
404	`not_found`	That doesn't exist.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
413	`too_large`	The request body is too large.
422	`validation_failed`	The request has invalid fields.
422	`idempotency_mismatch`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Slow down and try again.
500	`server_error`	Something went wrong on our side.
503	`unavailable`	The API isn't available right now. Try again shortly.

POST/webhook-endpoints/{id}/rotate-secret

curl -X POST "https://api.norreach.app/v1/webhook-endpoints/{id}/rotate-secret" \
  -H "Authorization: Bearer $NORREACH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Rotate the signing secret

{
  "id": "0f1a2b3c-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
  "object": "webhook_endpoint",
  "url": "https://hooks.example.com/norreach",
  "description": "CRM sync",
  "event_types": [
    "lead.submitted",
    "contact.created"
  ],
  "status": "active",
  "include_content": false,
  "disabled_reason": null,
  "created_by": "0b6f8a52-8d9e-4c1a-b7f3-5e2d9c4a1b00",
  "created_via_key": true,
  "previous_secret_valid_until": "2026-11-05T09:12:33.120Z",
  "created_at": "2026-11-04T09:12:33.120Z",
  "updated_at": "2026-11-04T09:12:33.120Z",
  "secret": "whsec_k3…"
}