Skip to main content
POST
cURL
Start a planned secret rotation by creating the next signing_secret. Add it to your receiver, then call Activate a staged webhook secret to begin the 1-hour overlap. Current deliveries keep using the existing secret until activation. If the response is lost, retry with the same Idempotency-Key; while the rotation is pending, the response contains the same secret.

Parameters

Key response fields

Example

Handle a 409 or a 422

What it does not do

  • Switch to the new secret. Deliveries keep carrying one signature, from the current secret, until you call Activate a staged webhook secret.
  • Change the endpoint’s url, status, event_types, or failure_count.
  • Survive a URL change. Sending a new url to Update a webhook drops the prepared secret, and you start again from here.
  • Return the secret later. Read endpoints never return signing_secret, so store this response somewhere safe.

Authorizations

Authorization
string
header
required

Legacy default or named integration API key, or OAuth 2.1 access token, in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Default keys retain full access; integration keys are limited to their approved read, webhooks, export and usage scopes and expire within 90 days. All credentials share the owner's account limits. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

Idempotency-Key
string

Optional safe-retry key. Reuse the same value only when retrying the exact same mutation request body; a different body returns 422 and an in-flight matching request returns 409.

Required string length: 1 - 255

Path Parameters

id
integer<int64>
required

Webhook endpoint id owned by the authenticated API key user.

Response

Webhook destination with the prepared signing secret

object
string
required
Allowed value: "webhook"
data
object
required
meta
object
required