Rotate a subscription's signing secret

POST
/hooks/subscriptions/{subscriptionId}/secret

Replaces a subscription's signing secret and returns the new one. Takes effect immediately and with no overlap window: the next attempt of every delivery, including one already queued, is signed with the new secret, so deliveries fail your signature check until your receiver has it.

Authorization

apiKey
Authorization<token>

API key as Bearer token: Authorization: Bearer

In: header

Path Parameters

subscriptionId*string

ID of the webhook subscription, as returned when it was created or listed.

Request Body

application/json

This operation takes no body fields, but the request must still carry Content-Type: application/json and a JSON body: send {}.

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://terac.com/api/external/v2/hooks/subscriptions/string/secret" \  -H "Content-Type: application/json" \  -d '{}'
{
  "secret": "string"
}
{
  "code": "BAD_REQUEST",
  "message": "Invalid input data",
  "issues": []
}

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key required. Include Authorization: Bearer <key> header."
  }
}

{
  "error": {
    "code": "FORBIDDEN",
    "message": "This account is not permitted to use the API."
  }
}

{
  "code": "NOT_FOUND",
  "message": "Not found",
  "issues": []
}
{
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Retry after 61 seconds."
  }
}
{
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal server error",
  "issues": []
}

Read a subscription's signing secret GET

Returns a subscription's current signing secret, for recovering one you no longer have. Rotate instead if you believe it leaked, since reading it does not invalidate anything.

List webhook deliveries GET

Lists webhook deliveries to your subscriptions, newest first, optionally for one subscription_id. One row per delivery, updated in place across retries, so id is the X-Event-ID your endpoint saw and attempt_count is how many tries it took. Confirmation pings are not logged here.