Rotate webhook secret

rotate_webhook_secret Add a second active signing secret, or retire the older one. Both secrets sign every request while two are active, so a receiver updates its configuration whenever it likes rather than deploying in lockstep with us. The new secret is returned ONCE.

Hosted MCP registration verified. These schemas describe the development contract; confirm supported inputs with tools/list. Generic CLI/HTTP calls require a matching development server. Configure LINKTRAIL_API_URL; production does not expose these command routes.

Access	Behavior
`watches:write`	Writes or admits work; can change or remove existing state

Reading saved data does not start a verification job. Mutations can change saved records or access; the effects below apply.

Example request

Connect through MCP, CLI, or HTTP. Replace example identifiers with records from your workspace.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "rotate_webhook_secret",
    "arguments": {
      "endpointId": "endpoint_example"
    }
  }
}

linktrail call rotate_webhook_secret --args '{"endpointId":"endpoint_example"}'

curl "$LINKTRAIL_API_URL/v1/commands/rotate_webhook_secret" \
  -H "Authorization: Bearer $LINKTRAIL_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"endpointId":"endpoint_example"}'

Returned result

Illustrative data validated against the documented response schema. IDs and dates are examples, not a live account capture. MCP returns this data in structuredContent and in a text content block; generic HTTP and CLI return the JSON result directly.

{
  "id": "endpoint_example",
  "active_secrets": 2,
  "retired": false,
  "secret": "whsec_example_not_a_credential"
}

Input fields

Omit optional fields when you do not want to supply them. Null is accepted only where listed. Unknown input properties are rejected.

Field	Type	Presence	Meaning and constraints
`endpointId`	string	Required	Identifier of the endpoint returned by its create or list operation. minLength: 1; maxLength: 200
`retire`	boolean	Optional	First call with false to issue a new secret, save it and update the receiver. Then call with true to retire the older secret; true alone never rotates. default: false

Validation and omitted values

With retire omitted or false, add a new secret. Store and test it before calling with retire:true to remove the older secret. Both secrets sign during overlap.

Defaults when omitted

Field	Default
`retire`	`false`

Output fields

Fields inside optional or nullable parents apply only when that parent exists. Common schema conventions explain evidence states, empty lists and extensions.

Field	Type	Presence	Meaning and constraints
`id`	string	Required	Resource identifier returned by the operation.
`active_secrets`	number	Required	active secrets recorded for this result.
`retired`	boolean	Required	retired recorded for this result.
`secret`	string	Optional	Webhook signing secret returned only when created or rotated. Store it securely.

Download input schema · Download output schema

Errors and retries

This command is not annotated idempotent. After a timeout, inspect existing state before repeating a write. See error recovery for status, scope, cooldown, cursor and retry handling. Unknown observations are result data and do not establish loss.

HTTP resource routes

These existing resource routes share the operation’s domain behavior. Their parameter placement, status and response envelope can differ from generic invocation. See HTTP route details.

Method and route	Success	Details
`POST /v1/webhooks/{endpointId}/secrets`	201	Remaining arguments go in a JSON object body. Empty or unreadable body is treated as {} by this resource handler; use {retire:true} to retire the older secret.

Continue

list_webhooks Follow the related workflow, inspect capability status, or return to the command index.

Overview

Cloud operations

Repository tools

HTTP and events

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue

​Example request

​Returned result

​Input fields

​Validation and omitted values

​Defaults when omitted

​Output fields

​Errors and retries

​HTTP resource routes

​Continue

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue