Rotate webhook secret

POST

webhook_endpoints

{uuid}

rotate_secret

curl --request POST \
  --url https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret \
  --header 'X-Api-Key: <api-key>' \
  --header 'X-App-Id: <api-key>'

const options = {method: 'POST', headers: {'X-App-Id': '<api-key>', 'X-Api-Key': '<api-key>'}};

fetch('https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret"

headers = {
    "X-App-Id": "<api-key>",
    "X-Api-Key": "<api-key>"
}

response = requests.post(url, headers=headers)

print(response.text)

require 'uri'
require 'net/http'

url = URI("https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-App-Id"] = '<api-key>'
request["X-Api-Key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "uuid": "6f1d3c2a-9b8e-4a7d-b5c4-1e2f3a4b5c6d",
  "url": "https://erp.example.com/webhooks/streamlined",
  "description": "ERP deposit sync",
  "events": [
    "deposit_link.paid",
    "deposit_link.payment_failed"
  ],
  "status": "enabled",
  "disabled_reason": null,
  "last_success_at": "2026-09-10T16:04:12Z",
  "last_failure_at": null,
  "created_at": "2026-09-10T15:00:00Z"
}

Authorizations

X-App-Id

string

header

required

App ID for authentication

X-Api-Key

string

header

required

API Key for authentication

Path Parameters

uuid

string

required

Response

Rotated. Includes the new secret.

uuid

string

url

string

description

string | null

events

string[]

status

enum<string>

Available options:

enabled,

disabled

disabled_reason

string | null

Why the endpoint switched itself off. Null while enabled.

last_success_at

string<date-time> | null

last_failure_at

string<date-time> | null

created_at

string<date-time>

secret

string

Signs every delivery. Returned only on create and rotate.

Example:

"whsec_Hk3m9QpXa7Tz2Lr8Vn4Bc6Wd1Ys5Fe0Gj"

⌘I

Rotate webhook secret

curl --request POST \
  --url https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret \
  --header 'X-Api-Key: <api-key>' \
  --header 'X-App-Id: <api-key>'

const options = {method: 'POST', headers: {'X-App-Id': '<api-key>', 'X-Api-Key': '<api-key>'}};

fetch('https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret"

headers = {
    "X-App-Id": "<api-key>",
    "X-Api-Key": "<api-key>"
}

response = requests.post(url, headers=headers)

print(response.text)

require 'uri'
require 'net/http'

url = URI("https://api.staging.streamlinedpayments.com/api/v1/webhook_endpoints/{uuid}/rotate_secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-App-Id"] = '<api-key>'
request["X-Api-Key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "uuid": "6f1d3c2a-9b8e-4a7d-b5c4-1e2f3a4b5c6d",
  "url": "https://erp.example.com/webhooks/streamlined",
  "description": "ERP deposit sync",
  "events": [
    "deposit_link.paid",
    "deposit_link.payment_failed"
  ],
  "status": "enabled",
  "disabled_reason": null,
  "last_success_at": "2026-09-10T16:04:12Z",
  "last_failure_at": null,
  "created_at": "2026-09-10T15:00:00Z"
}

Orders

Customers

Customer applications

Customer groups

Customer files

Customer addresses

Payouts

Invoices

Transactions

Products

Deposit links

Webhooks

Rotate webhook secret

Authorizations

Path Parameters

Response