Rotate a webhook signing secret
curl --request POST \
--url https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const url = 'https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch(url, options)
.then(res => res.json())
.then(json => console.log(json))
.catch(err => console.error(err));import requests
url = "https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)using RestSharp;
var options = new RestClientOptions("https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Bearer <token>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
using RestSharp;
var options = new RestClientOptions("https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Bearer <token>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
$headers=@{}
$headers.Add("Authorization", "Bearer <token>")
$response = Invoke-WebRequest -Uri 'https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret' -Method POST -Headers $headers{
"data": {
"id": "cmg1h7t2k0003v8p9d4q6xw2e",
"secret": "whsec_4f7a1c9e2b8d6f3a5c0e7b9d1f4a6c8e2b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a",
"secretRotatingUntil": "2026-09-15T02:15:30.000Z"
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}Webhooks
Rotate a webhook signing secret
Replaces the endpoint’s signing secret. The previous secret keeps verifying for 24 hours, so a receiver can switch without dropping deliveries; rotating again inside that window retires the older one at once. The new secret is returned exactly once. Requires canManageWebhooks.
POST
https://my.flowsign.app
/
api
/
v1
/
webhooks
/
{endpointId}
/
rotate-secret
Rotate a webhook signing secret
curl --request POST \
--url https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const url = 'https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch(url, options)
.then(res => res.json())
.then(json => console.log(json))
.catch(err => console.error(err));import requests
url = "https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)using RestSharp;
var options = new RestClientOptions("https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Bearer <token>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
using RestSharp;
var options = new RestClientOptions("https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Authorization", "Bearer <token>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
$headers=@{}
$headers.Add("Authorization", "Bearer <token>")
$response = Invoke-WebRequest -Uri 'https://my.flowsign.app/api/v1/webhooks/{endpointId}/rotate-secret' -Method POST -Headers $headers{
"data": {
"id": "cmg1h7t2k0003v8p9d4q6xw2e",
"secret": "whsec_4f7a1c9e2b8d6f3a5c0e7b9d1f4a6c8e2b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a",
"secretRotatingUntil": "2026-09-15T02:15:30.000Z"
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}{
"error": "Missing permission: canSendPackages",
"details": {
"recipients.0.email": [
"Invalid email"
]
}
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
The workspace the key was issued for, as returned by GET /api/v1/workspaces. Optional: omitting it acts in the key's workspace, and any other id is rejected with 401.
Path Parameters
Response
Success
Show child attributes
Show child attributes
Was this page helpful?

