Rotate webhook secret

rotate_webhook_secret Add a second active signing secret, or retire the older one. Both secrets sign every request while two are active, so a receiver updates its configuration whenever it likes rather than deploying in lockstep with us. The new secret is returned ONCE.

Name recorded in the 2026-10-17 deployment. This page describes current source; verify inputs and access in your connected catalog. Provider configuration and workspace access still apply.

Access	Behavior
`watches:write`	Writes or admits work; can change or remove existing state

This operation changes saved state. Review its inputs and retry behavior before calling.

Example request

Connect through MCP, CLI, or HTTP. Replace example identifiers with records from your workspace.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "rotate_webhook_secret",
    "arguments": {
      "endpointId": "endpoint_example"
    }
  }
}

agentlinkops call rotate_webhook_secret --args '{"endpointId":"endpoint_example"}'

curl --fail-with-body https://app.agentlinkops.com/v1/commands/rotate_webhook_secret \
  -H "Authorization: Bearer $AGENTLINKOPS_TOKEN" \
  -H 'Content-Type: application/json' \
  --data '{"endpointId":"endpoint_example"}'

Returned result

Schema-validated example; IDs and dates are illustrative. MCP returns this data in structuredContent and in a text content block; generic HTTP and CLI return the JSON result directly.

{
  "id": "endpoint_example",
  "active_secrets": 2,
  "retired": false,
  "secret": "whsec_example_not_a_credential"
}

Input fields

Omit optional fields when you do not want to supply them. Null is accepted only where listed. Unknown input properties are rejected.

Field	Type	Presence	Meaning and constraints
`endpointId`	string	Required	endpoint ID from create/list. minLength: `1`; maxLength: `200`
`retire`	boolean	Optional	First call with false to issue a new secret, save it and update the receiver. Then call with true to retire the older secret; true alone never rotates. default: `false`

Validation and omitted values

With retire omitted or false, add a new secret. Store and test it before calling with retire:true to remove the older secret. Both secrets sign during overlap.

Defaults when omitted

Field	Default
`retire`	`false`

Output fields

Fields inside optional or nullable parents apply only when that parent exists. Common schema conventions explain evidence states, empty lists and extensions.

Field	Type	Presence	Meaning and constraints
`id`	string	Required	Resource identifier returned by the operation.
`active_secrets`	number	Required
`retired`	boolean	Required
`secret`	string	Optional	Webhook signing secret returned only when created or rotated. Store it securely.

Download input schema · Download output schema

Errors and retries

This write is not annotated idempotent. After a timeout, inspect existing state before repeating it. Operation-specific errors include WEBHOOK_ROTATION_DENIED. See error recovery for status, scope, cooldown, cursor and retry handling. Unknown observations are result data and do not establish loss.

HTTP resource routes

These existing resource routes share the operation’s domain behavior. Their parameter placement, status and response envelope can differ from generic invocation. See HTTP route details.

Method and route	Success	Details
`POST /v1/webhooks/{endpointId}/secrets`	201	Remaining arguments go in a JSON object body. Empty or unreadable body is treated as {} by this resource handler; use {retire:true} to retire the older secret.

Continue

list_webhooks Follow the related workflow. See capability status for availability or the command index for another operation.

Overview

MCP, CLI and API commands

CLI client

HTTP and events

Optional local workflows

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue

​Example request

​Returned result

​Input fields

​Validation and omitted values

​Defaults when omitted

​Output fields

​Errors and retries

​HTTP resource routes

​Continue

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue