Webhook subscriptions

Rotate the signing secret

POSThttps://api.ruuster.com/v1/webhooks/{webhookId}/rotate-secret

Issue a new signing secret. The old one keeps signing alongside it for 24 hours.

Authentication: x-api-key and x-email headers of an owner or admin
Rate limit: 120 requests per minute per key
Changes only your webhook subscriptions, never your Ruuster data

No body. For 24 hours deliveries carry two v1= signatures, one per secret; deploy the new secret within that window. See Receiving and verifying.

Path parameters

Name	Type	Description
`webhookId`	string	The subscription id, `whk_…`

Response

secret (shown only here), secretHint, and previousSecretValidUntil.

Request

curl -s -X POST "https://api.ruuster.com/v1/webhooks/whk_2c7f9a4e1b/rotate-secret" \
  -H "x-api-key: $RUUSTER_API_KEY" \
  -H "x-email: $RUUSTER_EMAIL"

const res = await fetch("https://api.ruuster.com/v1/webhooks/whk_2c7f9a4e1b/rotate-secret", {
  method: "POST",
  headers: {
    "x-api-key": process.env.RUUSTER_API_KEY,
    "x-email": process.env.RUUSTER_EMAIL,
  },
});
const body = await res.json();
if (!body.ok) throw new Error(`${body.error.code}: ${body.error.message} (${body.requestId})`);
console.log(body.data);

import os
import requests

res = requests.post(
    "https://api.ruuster.com/v1/webhooks/whk_2c7f9a4e1b/rotate-secret",
    headers={"x-api-key": os.environ["RUUSTER_API_KEY"], "x-email": os.environ["RUUSTER_EMAIL"]},
    timeout=30,
)
body = res.json()
if not body["ok"]:
    raise RuntimeError(f'{body["error"]["code"]}: {body["error"]["message"]} ({body.get("requestId")})')
print(body["data"])