Summary
Mint a new signing secret and return it once. The previous secret stays valid for 24 hours (previous_secret_expires_at, previous_secret_active true). The previous secret value is not returned. PATCH /api/v1/webhooks/:id with a different secret does the same overlap and still redacts the secret in the response. Rotating again replaces the previous secret and resets the window. A hook with no secret just stores the new one. Same webhook_write permission as PATCH. During the window x-cooper-signature is sha256=<hex>,sha256=<hex> and x-cooper-signature-v2 is v1=<hex>,v1=<hex>, current secret first. Split on the comma and accept the delivery when any segment matches. After expiry only the current secret is signed. Another account's id is 404 webhook_not_found. MCP: cooper_rotate_webhook_secret.
Request
This call has no JSON body.
Response
The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.Errors
- HTTP 404 webhook_not_found
Idempotency
This route does not document Idempotency-Key or client_id.