Rotate the signing secret for a webhook endpoint

Generates a new HMAC-SHA256 signing secret, stores the hash in the DB and the plaintext in AWS Secrets Manager, and returns the plaintext ONCE. Update your webhook receiver to accept both the old and new secrets during the transition window, then drop the old secret once all in-flight deliveries are using the new one.

Requires webhooks:manage scope.

POST /webhook_endpoints/{id}/rotate_secret

Rotate the signing secret for a webhook endpoint

cURL

curl --request POST \
  --url https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.arcuserp.com/v1/webhook_endpoints/{id}/rotate_secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

200

{
  "webhook_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "secret": "<string>",
  "last4": "<string>",
  "rotated_at": "2023-11-07T05:31:56Z"
}

{
  "error": "not_found",
  "code": "not_found",
  "type": "not_found",
  "hint": "The requested order does not exist or does not belong to this entity.",
  "param": "expand[0]",
  "required": "accounts:read",
  "request_id": "req_abc123"
}

{
  "error": "not_found",
  "code": "not_found",
  "type": "not_found",
  "hint": "The requested order does not exist or does not belong to this entity.",
  "param": "expand[0]",
  "required": "accounts:read",
  "request_id": "req_abc123"
}

{
  "error": "not_found",
  "code": "not_found",
  "type": "not_found",
  "hint": "The requested order does not exist or does not belong to this entity.",
  "param": "expand[0]",
  "required": "accounts:read",
  "request_id": "req_abc123"
}

Authorizations

Authorization · string · header · required

API key issued per entity via Settings > Developers > API Keys. Each key carries scopes (e.g. orders:read, products:write). Bearer token format: Authorization: Bearer ark_live_ent_ Test keys use ark_test_ent_. Both are issued per entity via Settings > Developers > API Keys.

Path Parameters

id · string<uuid> · required

Response

200

application/json

Rotated secret (returned ONCE -- store immediately)

webhook_id · string<uuid>

secret · string

New plaintext secret (whsec_). Store immediately.

last4 · string

Last 4 hex chars of the new secret.

rotated_at · string<date-time>