Rotate Webhook Secret

POST /webhook-endpoints/{endpoint_id}/rotate-secret

Both secrets verify until the overlap window closes, so a partner rolls over without downtime (§4.1).

Role floor

Requires admin or above. The floor is a minimum, not a grant: scope filtering still applies on top of it, and a resource in another tenant answers 404 rather than 403.

Parameters

Name	In	Type		Notes
endpoint_id	path	string (uuid)	required	—

Request body — WebhookRotate

Field	Type		Notes
secret	string	required	min length 16 max length 400
overlap_seconds	integer	optional	Default 86400. min 0 max 2592000

Responses

Status	Description	Body
200	Successful Response	WebhookEndpointView
422	Validation Error	HTTPValidationError

Only the success paths are declared

Any operation may also answer any status in the error catalogue, and every failure body is the platform envelope — including the 422 this document types as HTTPValidationError.

Example

The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.

curl -X POST https://your-deployment.example.com/webhook-endpoints/{endpoint_id}/rotate-secret \
  -H "Authorization: Bearer $COBRE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
       "secret": "string"
     }'

Response — WebhookEndpointView

Field	Type		Notes
id	string (uuid)	required	—
agent_id	string (uuid)	required	—
slug	string	required	—
http_method	POST | GET | PUT	required	—
verification	hmac_sha256 | shared_token | none	required	—
secret_set	boolean	required	—
rotation_active	boolean	required	—
secret_overlap_until	string (date-time) | null	required, nullable	—
prompt_template	string	required	—
input_template	object | null	required, nullable	—
session_key_template	string | null	required, nullable	—
persona_slug_template	string | null	required, nullable	—
subject_template	object | null	required, nullable	—
response_mode	async | sync | callback | ack	required	—
response_path	string | null	required, nullable	—
callback_url	string | null	required, nullable	—
event_kind	string | null	required, nullable	—
rate_limit_per_minute	integer	required	—
coalescing	object	required	—
unverified_ack	boolean	required	—
call_count	integer	required	—
is_active	boolean	required	—
created_at	string (date-time)	required	—