Vike Data API

Alerts Rotate Webhook Secret

alerts_rotate_webhook_secret

Destructive

Rotate the signing secret of one of the user's webhook channels (ids from alerts_list_channels). A new secret is generated and returned as secret (show it to the user now; it is shown again any time on Account -> Alerts -> channels, Show secret). When the channel had a secret, the old one keeps signing for 24 hours (previous_secret_valid_until): until then every delivery carries TWO sig= values in X-Vike-Signature (the new secret's first, the old one's second). A receiver must accept a delivery if ANY sig= value matches its secret; one that compares a single value rejects deliveries during those 24 hours. Rotating again inside them ends the first overlap. A legacy channel that had no secret rotates without overlap (previous_secret_valid_until is null, one sig=). Install the new secret, then call alerts_test_webhook to check it.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "channel_id": "<channel_id>"
    },
    "name": "alerts_rotate_webhook_secret"
  }
}

Input Schema

Name	Required	Description	Default
`channel_id`	Yes	The webhook channel id (from alerts_list_channels).

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 31, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the annotations: it discloses the returned fields (`secret`, `previous_secret_valid_until`), the 24-hour dual-signature overlap window and its receiver-side consequence, what happens if you rotate again inside the overlap, and the legacy no-secret case where `previous_secret_valid_until` is null. This is exactly the behavioral detail an agent cannot infer from destructiveHint=true / idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action and return value are front-loaded, and the overlap explanation is genuinely necessary to interpret the response correctly. It is dense but mostly earns its length; the receiver-acceptance digression is useful to relay to a user but is the one segment that could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description fully carries the burden of explaining return values and their semantics, and it does so explicitly (`secret`, `previous_secret_valid_until`, null case). For a single-parameter, destructive mutation tool, nothing an agent needs to call and interpret it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter is already documented as 'The webhook channel id (from alerts_list_channels).' The description's 'ids from alerts_list_channels' largely restates the schema, adding no new type, format, or validation detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Rotate the signing secret of one of the user's webhook channels') and immediately scopes it to a single channel id sourced from alerts_list_channels. It is trivially distinguishable from alerts_register_webhook, alerts_edit, and alerts_test_webhook, which it references.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly signals the pre-condition (ids come from alerts_list_channels) and the follow-up workflow ('Install the new secret, then call alerts_test_webhook to check it'), which routes the agent to the right sibling. There is no explicit when-not-to-use guidance (e.g., register vs rotate for a channel that has no webhook), but the operational context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Vike Data API tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.