Dravo.

Rotate secret

View .md

Roll an endpoint's signing secret. The old one stays valid for 24h so receivers can migrate.

Generate a new signing secret for an endpoint — for example if the old one leaked. The new secret is returned once. For the next 24 hours Dravo dual-signs every delivery with both the new and the previous secret (two comma-separated values in X-Dravo-Signature), so a receiver that still holds the old secret keeps verifying while you roll out the new one. After the grace window only the new secret is sent. See verifying the signature.

POST/v1/webhooks/{webhook_id}/rotate-secret
API key (dra_…) or dashboard JWT

Rotate the signing secret. The previous secret stays valid for 24h (dual-signed) so receivers can migrate. The new secret is shown once.

Authorizationstringheaderrequired

Bearer token. Use a Dravo API key (`dra_...`) or a dashboard JWT.

webhook_idstringpathrequired

Endpoint whose secret to rotate.

idstring

Webhook endpoint id.

urlstring

Destination URL events are POSTed to.

eventsstring[]

Subscribed events: post.published, post.failed, post.queued, connection.revoked.

activeboolean

Whether the endpoint currently receives deliveries.

signing_secretstring

The new secret (whsec_…). The previous one stops working.

const response = await fetch("https://api.dravo.dev/v1/webhooks/{webhook_id}/rotate-secret", {  method: "POST",  headers: {  "Authorization": "Bearer " + process.env.DRAVO_API_KEY,}});const data = await response.json();console.log(data);
{  "id": "wh_1",  "url": "https://example.com/hook",  "events": [    "post.published"  ],  "active": true,  "signing_secret": "whsec_…"}