Skip to content
ShortsIntel
Create a key

API referenceWebhooks

Rotate a signing secret

POST/v1/webhooks/{id}/rotate

Mints a new signing secret. The old one keeps working for 24 h, and during that window every delivery is signed with both: the header carries two v1= values over the same t and body. A verifier written the documented way — does any v1 match? — needs no change at all. Owner or admin only: a MEMBER's key or connection gets 403 forbidden.

Price

Free.

Parameters

NameInTypeRequiredDefaultDescription
idpathstringRequired—Webhook endpoint id.

Responses

200 OK

{ webhook, secret, overlap_expires_at } — secret shown once.

object

  • webhookobjectrequired
    • idstringrequired
    • urlstringrequired
    • statusstringrequiredone of pending, active, failed, disabled
    • descriptionstringrequirednullable
    • secret_prefixstringrequiredThe first characters of the signing secret, to tell two apart.
    • previous_secret_expires_atstringrequirednullable
    • created_atstringrequired
    • activated_atstringrequirednullable
    • last_delivery_atstringrequirednullable
  • secretstringrequired
  • overlap_expires_atstringrequirednullableUntil then, every delivery is signed with both secrets.

200 · `{ webhook, secret, overlap_expires_at }` — `secret` shown once.

{
  "webhook": {
    "id": "whe_6d2f10ab44",
    "url": "https://hooks.example.com/shortsintel",
    "status": "active",
    "description": "production receiver",
    "secret_prefix": "whsec_d4e5f6",
    "previous_secret_expires_at": "2026-09-09T09:14:02.418Z",
    "created_at": "2026-09-08T09:14:02.418Z",
    "activated_at": "2026-09-08T09:14:03.006Z",
    "last_delivery_at": "2026-09-08T09:14:03.006Z"
  },
  "secret": "whsec_Lm2Rv8ZaQe5tYb1nXc7pKd3sWu9jHg6F",
  "overlap_expires_at": "2026-09-09T09:14:02.418Z"
}

401 Unauthorized

missing_authorization, invalid_key, key_revoked or invalid_token.

object

RFC 9457 problem document, served as application/problem+json. Branch on code, never on the prose.

  • typestringrequired
  • titlestringrequired
  • statusintegerrequired
  • codestringrequiredone of missing_authorization, invalid_key, key_revoked, invalid_token, organization_not_selected, organization_access_revoked, connection_revoked, forbidden, invalid_request, unsupported_platform, unsupported_kind, kind_deprecated, not_found, video_too_long, idempotency_conflict, run_not_ready, advertiser_ambiguous, insufficient_balance, rate_limit_exceeded, concurrency_limit_exceeded, tracker_limit_exceeded, webhook_limit_exceeded, webhook_rotation_in_progress, collection_limit_exceeded, collection_name_taken, collection_kind_mismatch, media_unavailable, vendor_error, source_unavailable, service_unavailable, internal_errorStable machine-readable code.
  • detailstring

401 · Example

{
  "type": "https://www.shortsintel.com/docs/reference/errors/invalid_key",
  "title": "Invalid key",
  "status": 401,
  "code": "invalid_key",
  "detail": "That API key does not exist. Keys look like `sk_live_...` and are created in the console."
}

403 Forbidden

forbidden — the key's or connection's user is a MEMBER; only an owner or admin manages webhooks.

object

RFC 9457 problem document, served as application/problem+json. Branch on code, never on the prose.

  • typestringrequired
  • titlestringrequired
  • statusintegerrequired
  • codestringrequiredone of missing_authorization, invalid_key, key_revoked, invalid_token, organization_not_selected, organization_access_revoked, connection_revoked, forbidden, invalid_request, unsupported_platform, unsupported_kind, kind_deprecated, not_found, video_too_long, idempotency_conflict, run_not_ready, advertiser_ambiguous, insufficient_balance, rate_limit_exceeded, concurrency_limit_exceeded, tracker_limit_exceeded, webhook_limit_exceeded, webhook_rotation_in_progress, collection_limit_exceeded, collection_name_taken, collection_kind_mismatch, media_unavailable, vendor_error, source_unavailable, service_unavailable, internal_errorStable machine-readable code.
  • detailstring

403 · Example

{
  "type": "https://www.shortsintel.com/docs/reference/errors/forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Only an owner or admin can manage webhooks."
}

409 Conflict

webhook_rotation_in_progress while a previous overlap is open.

object

RFC 9457 problem document, served as application/problem+json. Branch on code, never on the prose.

  • typestringrequired
  • titlestringrequired
  • statusintegerrequired
  • codestringrequiredone of missing_authorization, invalid_key, key_revoked, invalid_token, organization_not_selected, organization_access_revoked, connection_revoked, forbidden, invalid_request, unsupported_platform, unsupported_kind, kind_deprecated, not_found, video_too_long, idempotency_conflict, run_not_ready, advertiser_ambiguous, insufficient_balance, rate_limit_exceeded, concurrency_limit_exceeded, tracker_limit_exceeded, webhook_limit_exceeded, webhook_rotation_in_progress, collection_limit_exceeded, collection_name_taken, collection_kind_mismatch, media_unavailable, vendor_error, source_unavailable, service_unavailable, internal_errorStable machine-readable code.
  • detailstring

409 · Example

{
  "type": "https://www.shortsintel.com/docs/reference/errors/webhook_rotation_in_progress",
  "title": "Webhook rotation in progress",
  "status": 409,
  "code": "webhook_rotation_in_progress",
  "detail": "The previous secret is still valid. Rotate again after the overlap closes.",
  "overlap_expires_at": "2026-09-09T09:14:02.418Z"
}

Request samples

curl -X POST "https://www.shortsintel.com/v1/webhooks/whe_6d2f10ab44/rotate" \
  -H "Authorization: Bearer sk_live_YOUR_KEY"
  • Webhooks: The events we send, how to verify a signature, what happens when your endpoint is down, and how to rotate a secret.