cURL
curl --request POST \
--url https://api.nohead.io/v1/webhooks/{webhook_id}/secrets \
--header 'Authorization: Bearer <token>'import { Nohead } from "@nohead/sdk"
const nohead = new Nohead()
const result = await nohead.webhooks.rotateSecret("wh_01J9ZQ3F8X")
from nohead import Nohead
nohead = Nohead()
result = nohead.webhooks.rotate_secret("wh_01J9ZQ3F8X")
require "nohead"
nohead = Nohead::Client.new
result = nohead.webhooks.rotate_secret("wh_01J9ZQ3F8X")
{
"id": "whs_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"object": "webhook_secret",
"webhook_id": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"created_at": "2026-09-27T12:00:00.000Z",
"secret": "<string>"
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}Webhooks
Rotate a webhook's signing secret
Adds a secret, shown only in this response. Deliveries are signed with
it from now on, and with the secrets before it for 24 hours more
(Standard Webhooks sends several signatures), so receivers can switch
without rejecting any. Retire an old one sooner with
DELETE /v1/webhook-secrets/{secret_id}.
POST
/
v1
/
webhooks
/
{webhook_id}
/
secrets
cURL
curl --request POST \
--url https://api.nohead.io/v1/webhooks/{webhook_id}/secrets \
--header 'Authorization: Bearer <token>'import { Nohead } from "@nohead/sdk"
const nohead = new Nohead()
const result = await nohead.webhooks.rotateSecret("wh_01J9ZQ3F8X")
from nohead import Nohead
nohead = Nohead()
result = nohead.webhooks.rotate_secret("wh_01J9ZQ3F8X")
require "nohead"
nohead = Nohead::Client.new
result = nohead.webhooks.rotate_secret("wh_01J9ZQ3F8X")
{
"id": "whs_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"object": "webhook_secret",
"webhook_id": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"created_at": "2026-09-27T12:00:00.000Z",
"secret": "<string>"
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}{
"error": {
"type": "invalid_request",
"message": "<string>",
"request_id": "req_01J9ZQ3F8X5W2K7M4N6P0R1S2T",
"details": [
{
"code": "<string>",
"message": "<string>",
"field": "<string>",
"usage": 123,
"limit": 123,
"current_revision": 123,
"record_id": "<string>",
"draft_id": "<string>"
}
]
}
}Authorizations
Project-scoped API key, e.g. nohead_sk_k7fz0a9c3m2q_<secret>, or
nohead_pk_… for a published-only key. Used by servers, CI, the CLI
and coding agents.
Headers
A unique value (1-255 printable ASCII characters) that makes retrying
this request safe. The first response (below 500) is stored for 24
hours per user or API key; retries with the same key and the same
request get it again with an Idempotent-Replayed: true header. The
same key with a different request is refused with 400; a retry while
the first request is still running gets 409.
Required string length:
1 - 255First-party client identifier recorded in history (e.g. cli/0.3.1). Informational only.
Path Parameters
Response
The new secret, with its value.
Example:
"whs_01J9ZQ3F8X5W2K7M4N6P0R1S2T"
When it stops signing deliveries; null for the newest secret.
ISO 8601 timestamp in UTC.
Example:
"2026-09-27T12:00:00.000Z"
The signing secret (whsec_...), shown only when it is added. Keep it private.