Rotate Webhook Secret
curl --request POST \
--url https://app.tuco.ai/api/webhooks/{id}/rotate-secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.tuco.ai/api/webhooks/{id}/rotate-secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.tuco.ai/api/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.tuco.ai/api/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.tuco.ai/api/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.tuco.ai/api/webhooks/{id}/rotate-secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.tuco.ai/api/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "<string>",
"secret": "<string>",
"warning": "<string>"
}Webhooks
Rotate Webhook Secret
Replace a Tuco webhook’s signing secret. The new secret is returned once; every delivery and replay after this is signed with it.
POST
/
api
/
webhooks
/
{id}
/
rotate-secret
Rotate Webhook Secret
curl --request POST \
--url https://app.tuco.ai/api/webhooks/{id}/rotate-secret \
--header 'Authorization: Bearer <token>'import requests
url = "https://app.tuco.ai/api/webhooks/{id}/rotate-secret"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.tuco.ai/api/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.tuco.ai/api/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.tuco.ai/api/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.tuco.ai/api/webhooks/{id}/rotate-secret")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.tuco.ai/api/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"id": "<string>",
"secret": "<string>",
"warning": "<string>"
}Generates a new signing secret for the webhook and returns it once. Every delivery
from now on, including replays, is
signed with the new secret. Update your endpoint’s verification before rotating, or
accept both secrets for a short overlap.
Authentication
Authorization: Bearer tuco_xxxxxxxxxxxxx
Path parameters
string
required
Webhook ID.
Response
string
Webhook ID.
string
The new secret. Store it now; it is never shown again.
string
Reminder that the secret is shown once.
| Status | When |
|---|---|
200 | Rotated |
401 | Missing or invalid API key |
402 | Workspace is read-only (billing) |
404 | Webhook not found in your workspace |
Example
curl -X POST "https://app.tuco.ai/api/webhooks/680a1b2c3d4e5f6789012345/rotate-secret" \
-H "Authorization: Bearer tuco_xxxxxxxxxxxxx"
{
"id": "680a1b2c3d4e5f6789012345",
"secret": "q1Vb3m8YqGv0pX7nKc2Zr5tLw9EaHd4JfU6sNyB0iOk=",
"warning": "Save this secret now. You will not be able to see it again."
}