Make a new signing secret; the old one keeps signing for 24 hours
Operation ID: rotateWebhookSecret
Returns the new secret. For 24 hours each message carries two signatures, one per secret, so a receiver can switch without missing a message.
Needs an API key with the manage scope.
apiKeyAuthorizationBearer <oq_ followed by 43 letters and digits>An Outqube API key, made in the app's settings. It belongs to one app and has the scope read, trigger or manage; a higher scope includes the lower ones. A revoked or expired key is a 401.
webhookId*stringThe endpoint's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidOK
application/json- response
An endpoint with its signing secret, returned only on create and on rotate.
id*stringThe endpoint's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidapp_id*stringThe app the endpoint belongs to.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidurl*stringWhere Outqube sends the events.
urievents*array<string>Event types sent, or ["*"] for all of them.
description*stringYour note on what the endpoint is for; empty when not set.
enabled*booleanWhether Outqube sends events to the endpoint.
disabled_reason*|manual: switched off by a person. failures: 5 messages in a row ran out of retries. Null while enabled.
disabled_at*|When it was switched off, or null.
consecutive_failures*integerMessages in a row that ran out of retries; any delivery resets it.
-9007199254740991 <= value <= 9007199254740991secret_hint*stringThe last 4 characters of the signing secret.
previous_secret_expires_at*|After a rotation, when the previous secret stops signing; else null.
created_at*stringWhen the endpoint was created.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timeupdated_at*stringWhen the endpoint last changed.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timesecret*stringThe signing secret, whsec_ + base64. Shown here and in settings.
curl -X POST 'https://app.outqube.com/api/v1/webhooks/d8f0b2a4-6c1e-4d73-9a5b-1c3e5a7b9d46/rotate-secret'{ "id": "d8f0b2a4-6c1e-4d73-9a5b-1c3e5a7b9d46", "app_id": "9b1d2f4e-7a3c-4c58-9e0b-6f3a1d2c4b5a", "url": "https://ci.acme.test/hooks/outqube", "events": [ "run.completed", "run.cancelled" ], "description": "Post results to CI", "enabled": true, "disabled_reason": null, "disabled_at": null, "consecutive_failures": 0, "secret_hint": "k3Fz", "previous_secret_expires_at": "2026-10-31T10:00:00.000Z", "created_at": "2026-10-25T10:00:00.000Z", "updated_at": "2026-10-25T10:00:00.000Z", "secret": "whsec_c2FtcGxlLXdlYmhvb2sta2V5LW5vdC1hLXNlY3JldCE="}