Rotate a webhook secret
cooper_rotate_webhook_secretUse this when a webhook signing secret should change without breaking receivers that still check the old secret. Requires auth. Inputs: webhook_id (required). Mints a new secret (whsec_…), stores it as the current secret, and keeps the previous secret valid for 24 hours. Returns the webhook with the new secret in full once, previous_secret_expires_at (ISO-8601), and previous_secret_active true. The previous secret value is not returned. For those 24 hours each delivery sends x-cooper-signature as sha256=,sha256= and x-cooper-signature-v2 as v1=,v1=, current secret first. Verify by splitting on the comma and accepting the delivery when any segment matches. Rotating again replaces the previous secret and resets the 24 hour window. A hook with no secret just stores the new one. Needs webhook_write, the same permission as updating a webhook. Fails with 404 webhook_not_found or 403 permission_denied.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| webhook_id | Yes | Webhook id (wh_…) whose signing secret should rotate |