WEBHOOKS

Roll the signing secret

POST


                    roadrunnerzw.com/api/v1/webhooks/{id}/rotate

Issues a new secret and keeps the old one valid for a window.

The response carries the new secret ONCE. Both secrets sign outgoing messages until the overlap expires, so this can be called before the client has deployed anything.

REQUEST

curl -X POST https://roadrunnerzw.com/api/v1/webhooks/{id}/rotate \
  -H 'Authorization: Bearer rr_live_your_key_id' \
  -H 'X-RR-Timestamp: $(date +%s)' \
  -H 'X-RR-Signature: $SIGNATURE'

Path

id string REQUIRED

Responses

200 OK

401 Unauthenticated

The signature, key or timestamp did not check out. Also returned for a revoked key, and for a timestamp more than 300 seconds from ours.

403 Forbidden

The key is valid but was not issued the scope this endpoint requires. Scopes are fixed at issue, so this needs a new key rather than a retry.

404 Not found

No such delivery for this client. Deliveries are scoped to the key that created them, so another client's id reads as missing rather than forbidden.

429 Too many requests

Too many requests for this client. Back off and retry; the response carries Retry-After and X-RateLimit-* headers.