Roll an endpoint's signing secret

POST/v1/webhook_endpoints/{id}/roll_secret

Creates a new signing secret and returns the endpoint with it in secret — the only time it is shown. The previous secret stays valid for 24 hours (previous_secret_expires_at): during that window every request carries two v1 values in Parasend-Signature, t=<t>,v1=<hmac with new>,v1=<hmac with previous>, so the receiver can switch without a gap. Rolling again inside the window drops the older previous secret at once (only one previous secret is kept). Audit webhook_endpoint.secret_rolled.

Path parameters

idstringrequired

The webhook endpoint's ID, starting whk_.

Returns

200 application/json. The endpoint, with the new secret in secret. See the WebhookEndpoint object.

Errors have one shape; see Errors for every code.

Code language

Request

curl -X POST "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret" \
  -H "Authorization: Bearer $PARASEND_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

const res = await fetch('https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.PARASEND_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
  },
});
const data = await res.json();

import os, requests, uuid

res = requests.post(
    "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret",
    headers={
        "Authorization": f"Bearer {os.environ['PARASEND_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
)
data = res.json()

using var http = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("PARASEND_KEY"));
request.Headers.Add("Idempotency-Key", Guid.NewGuid().ToString());
var response = await http.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();

var request = HttpRequest.newBuilder(URI.create("https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret"))
    .header("Authorization", "Bearer " + System.getenv("PARASEND_KEY"))
    .header("Idempotency-Key", UUID.randomUUID().toString())
    .method("POST", HttpRequest.BodyPublishers.noBody())
    .build();
var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

$client = new GuzzleHttp\Client();
$response = $client->request('POST', 'https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('PARASEND_KEY'),
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
]);
$data = json_decode($response->getBody(), true);

Response · 200

{
  "id": "whk_01M6R27T4KCSN7M0CHFGVH7JRA",
  "object": "webhook_endpoint",
  "url": "https://hooks.fyrirtaeki.example/parasend",
  "event_types": [
    "delivery.confirmed",
    "delivery.bounced",
    "delivery.expired"
  ],
  "description": "Case system",
  "secret": "whsec_rRFB9XFIxFTnLDYnjK9XUyGO61WwvXXRNq9Nfw5cBuQ",
  "auth": {
    "mode": "none",
    "static_bearer": null,
    "oauth2": null
  },
  "delivery_sources": null,
  "status": "enabled",
  "livemode": false,
  "exhausted_events": 0,
  "last_exhausted_at": null,
  "retrying_events": 0,
  "last_attempt": {
    "created": "2026-11-06T09:15:05.775Z",
    "ok": true,
    "status_code": 200,
    "latency_ms": 0,
    "failure_stage": null,
    "error": null,
    "replay": true,
    "test": false
  },
  "created_by": {
    "user_id": "usr_01M6R27SYD4B50414S0BZ4KBKR",
    "name": "Jóna Jónsdóttir",
    "via": "api_key"
  },
  "previous_secret_expires_at": "2026-11-07T09:15:05.963Z",
  "created": "2026-11-06T09:15:05.746Z"
}