Rotate an endpoint signing secret
curl --request POST \
--url https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate \
--header 'Idempotency-Key: <idempotency-key>' \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate"
headers = {
"Idempotency-Key": "<idempotency-key>",
"X-API-Key": "<api-key>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', 'X-API-Key': '<api-key>'}
};
fetch('https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Idempotency-Key: <idempotency-key>",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("X-API-Key", "<api-key>")
.asString();using RestSharp;
var options = new RestClientOptions("https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Idempotency-Key", "<idempotency-key>");
request.AddHeader("X-API-Key", "<api-key>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
{
"signing_secret": "whsec_bmV3X3NpZ25pbmdfc2VjcmV0"
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}Payment Webhooks
Rotate Signing Secret
Rotate an endpoint signing secret idempotently
POST
/
v1
/
webhook_endpoints
/
{id}
/
signing_secret
/
rotate
Rotate an endpoint signing secret
curl --request POST \
--url https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate \
--header 'Idempotency-Key: <idempotency-key>' \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate"
headers = {
"Idempotency-Key": "<idempotency-key>",
"X-API-Key": "<api-key>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Idempotency-Key': '<idempotency-key>', 'X-API-Key': '<api-key>'}
};
fetch('https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Idempotency-Key: <idempotency-key>",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate")
.header("Idempotency-Key", "<idempotency-key>")
.header("X-API-Key", "<api-key>")
.asString();using RestSharp;
var options = new RestClientOptions("https://api.sbx.moduluslabs.io/v1/webhook_endpoints/{id}/signing_secret/rotate");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Idempotency-Key", "<idempotency-key>");
request.AddHeader("X-API-Key", "<api-key>");
var response = await client.PostAsync(request);
Console.WriteLine("{0}", response.Content);
{
"signing_secret": "whsec_bmV3X3NpZ25pbmdfc2VjcmV0"
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "INVALID_DESCRIPTION",
"message": "description must be 255 characters or fewer.",
"correlation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}Replace the stored endpoint secret promptly and keep rotation requests
idempotent. Do not assume that creating, listing, or retrieving an endpoint
returns its secret; only the dedicated signing-secret operations do.
Authorizations
A Modulus API key with the required webhook scope.
Headers
Unique key for this signing-secret rotation. Reuse the same key only when retrying the same operation.
Path Parameters
Webhook endpoint identifier returned by the create operation.
Response
Signing secret rotated. This response contains the new secret.
Endpoint-specific secret used to verify Standard Webhooks signatures.
Pattern:
^whsec_Example:
"whsec_dGVzdF9zaWduaW5nX3NlY3JldA=="
Was this page helpful?