Webhooks

Rotate signing secret

POSThttps://api.firstleeward.com/v0/webhooks/:id/rotate-secret

Mints a new HMAC signing secret and returns it exactly once. The previous secret is invalidated immediately; in-flight deliveries signed with the old secret will fail verification on your endpoint and be retried automatically by the platform.

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Idempotency-Keystring

Unique key for safely retrying this request. Up to 255 characters; we recommend a UUIDv4. The first request executes and its response is cached; subsequent requests with the same key replay the cached response (24h retention).

Path Parameters

idstring<uuid>required

Webhook ID

Response

200Webhook with its newly minted signing secret. The previous secret is no longer accepted.

idstring<uuid>required

Unique webhook identifier

namestringrequired

Human-readable label

urlstringrequired

HTTPS endpoint that receives signed POSTs

statusstringrequired

Lifecycle status. Disabled webhooks receive no deliveries.

Available options:ACTIVEDISABLED

modestringrequired

Interaction pattern of the endpoint.

Available options:NOTIFICATIONREQUEST

lastUsedAtstring<date-time> | nullrequired

Timestamp of the most recent successful delivery

createdAtstring<date-time>required

ISO 8601 creation timestamp

updatedAtstring<date-time>required

ISO 8601 last update timestamp

signingSecretstringrequired

HMAC signing secret. Returned exactly once. Store it securely - it cannot be retrieved again. The previous secret (if any) is invalidated immediately.

404Webhook not found

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

detailobject | nullrequired