Rotate a webhook subscription secret

Replaces the signing secret and exposes it once with the subscription record.

POST https://app.upfour.io/v1/webhook-subscriptions/{subscriptionID}/rotate-secret

A real request. Sending it changes data in your up4 account.

Authorization

AuthorizationA pls_ key. It stays in this browser tab. Needs webhook.write.

Path

subscriptionIDpath · requiredPart of the request path.

Headers

Idempotency-KeyheaderGenerated automatically when empty. How it works

Sent directly from your browser to https://app.upfour.io/v1. Mutating calls get an automatic Idempotency-Key when the field is empty.

Request

Responsenot sent yet

Fill in a key and press Send request (⌘↵).
The answer appears here.

scope webhook.write beta Idempotency-Key supported returns 200

Parameters

Field	Type	Description
`subscriptionID` required	uuid	path parameter

Returns

A successful request returns 200 with application/json.

Response fields 1 top-level fields

Field Type Description

data WebhookSubscriptionCreated

WebhookSubscriptionCreated · 11 fields

Field	Type	Description
`active`	boolean
`created_at`	string (date-time)
`events`	string[] · nullable
`failure_count`	integer
`id`	uuid
`org_id`	uuid
`secret`	string	Signing secret of the subscription, `whsec_` plus 64 hex characters. Returned by this call only; list, update and read calls never include it. Store it now: a lost secret cannot be read back, only replaced with POST /webhook-subscriptions/{subscriptionID}/rotate-secret. The old secret stops signing at once.
`updated_at`	string (date-time)
`url`	string
`disabled_at`	string (date-time)	Set while the subscription is switched off, by active: false or by the delivery worker after repeated failures.
`last_delivery_at`	string (date-time)

Errors

Only the errors this operation can return. Every error uses the same envelope.

Status	Code	Meaning
400	`bad_request`	The request is malformed or fails validation.
404	`not_found`	The requested resource does not exist or is outside the caller's scope.
403	`permission_denied`	The credentials do not permit this action.

Every call can also return unauthorized (401), rate_limit_exceeded (429) or internal_error (500 / 502). See Responses and errors.

const res = await fetch("https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret", { method: "POST", headers: { Authorization: `Bearer ${process.env.UP4_API_KEY}`, }, }); console.log(res.status, await res.json());

import os import requests res = requests.post( "https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret", headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"}, ) print(res.status_code, res.json())

package main import ( "fmt" "io" "net/http" "os" ) func main() { req, _ := http.NewRequest("POST", "https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret", nil) req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY")) res, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer res.Body.Close() out, _ := io.ReadAll(res.Body) fmt.Println(res.StatusCode, string(out)) }

<?php $ch = curl_init("https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret"); curl_setopt_array($ch, [ CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => [ "Authorization: Bearer " . getenv("UP4_API_KEY"), ], ]); $response = curl_exec($ch); echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n"; curl_close($ch);

{ "data": { "active": false, "created_at": "2026-01-15T09:30:00Z", "events": [ "example" ], "failure_count": 1, "id": "3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90", "org_id": "3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90", "secret": "example", "updated_at": "2026-01-15T09:30:00Z", "url": "https://example.com" } }