RevKeenDocs
StatusSupport
API Reference
🔔 Webhooks & EventsWebhook Endpoints

Rotate signing secret

Generate a new signing secret for a webhook endpoint. The old secret is immediately invalidated. Store the new secret securely — it is only returned in this response.

POST/webhook-endpoints/{id}/rotate-secret

Generate a new signing secret for a webhook endpoint. The old secret is immediately invalidated. Store the new secret securely — it is only returned in this response.

Related endpoints

  • GET /webhook-endpoints — List webhook endpoints
  • POST /webhook-endpoints — Create webhook endpoint
  • GET /webhook-endpoints/{id} — Get webhook endpoint
  • PATCH /webhook-endpoints/{id} — Update webhook endpoint
  • DELETE /webhook-endpoints/{id} — Delete webhook endpoint
  • POST /webhook-endpoints/{id}/redeliver — Redeliver an event to this endpoint

Common errors

  • 400 invalid_request — malformed payload or failed validation.
  • 401 authentication_error — missing, invalid, expired, or revoked credential. Codes: authentication_failed, invalid_api_key, expired_api_key, api_key_revoked, session_invalid, merchant_required. Carries a WWW-Authenticate: Bearer challenge.
  • 404 resource_missing — the referenced resource does not exist or is not visible to your key.

Idempotency

Pass an Idempotency-Key header (UUID v4 recommended) to make retries safe. Keys are valid for 24 hours; see the idempotency guide.

Authorization

x-api-key<token>

Your RevKeen merchant API key. Create and manage keys in Dashboard → Settings → Developer. Use rk_sandbox_* for staging/test and rk_live_* for production. The same key may be sent as Authorization: Bearer <key> if that suits your HTTP client better. A missing, invalid, expired, or revoked key returns 401 with a WWW-Authenticate: Bearer challenge; a valid key without the required scope returns 403.

In: header

Path Parameters

id*string

Webhook endpoint ID

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

Stuck on an error response? Ask the RevKeen assistant to explain it.
curl -X POST "https://api.revkeen.com/v2/webhook-endpoints/11111111-1111-4111-8111-111111111111/rotate-secret" \
  -H "x-api-key: $REVKEEN_API_KEY"

Synthetic documentation data, validated against the response schema; not a live API result.

{  "data": {    "id": "1b2c3d4e-5f6a-4b7c-9d8e-0f1a2b3c4d98",    "url": "https://example.com/webhooks/revkeen",    "description": "Production webhook endpoint",    "enabled_events": [      "invoice.paid",      "subscription.created"    ],    "status": "enabled",    "circuit_breaker_state": "closed",    "total_deliveries": 12,    "successful_deliveries": 12,    "failed_deliveries": 0,    "last_delivery_at": "2026-04-02T11:30:00.000Z",    "created_at": "2026-04-02T10:00:00.000Z",    "updated_at": "2026-04-02T10:05:00.000Z"  }}

Put this endpoint to work

Handle webhook events

Verify webhook signatures