Rotate a webhook signing secret
A new signing secret, in the answer and only there. For 24 hours each delivery carries two signatures in webhook-signature, one with each secret, so the receiver can switch without losing any; then only the new one.
apiKeyAuthorizationBearer <token>An API key from the web app, under Developers. It starts with rz_live_.
id*stringThe webhook endpoint's id (wh_).
length <= 100Idempotency-Key?string1 to 255 printable characters, new for each request (a UUID); the body up to 1 MB. For 24 hours a repeat with the same key, path and body gets the first answer, with Idempotent-Replayed: true, instead of running again; 5xx, 409 and 429 answers are not kept. Errors, Retries, has the rest.
1 <= length <= 255OK
application/json- response
endpoint*secret*stringThe signing secret (whsec_ and base64), shown only now: keep it where your receiver reads it. Each delivery's webhook-signature is v1, and the base64 HMAC-SHA256, keyed with the base64 after whsec_, of <webhook-id>.<webhook-timestamp>.<body>.
curl -X POST 'https://api.rizamo.com/v1/webhooks/wh_01m4m44q00ea9a11gpjs99ddcy/rotate-secret' \ -H 'Idempotency-Key: 4b9e7c1a-2f3d-4e8a-9c6b-1d2e3f4a5b6c'{ "endpoint": { "id": "wh_01m4m44q00ea9a11gpjs99ddcy", "url": "https://hooks.cafelumen.pt/rizamo", "description": "Posts to our CRM", "events": [ "post.published", "post.failed", "post.target.failed" ], "profileIds": null, "status": "active", "disabledReason": null, "breaker": "closed", "failingSince": null, "disablesAt": null, "successRate": 100, "lastDeliveryAt": "2026-11-06T09:00:04.000Z", "createdBy": { "type": "api_key", "keyId": "key_01m4qw9xw0fem94hjmcppyba8c", "name": "CRM sync" }, "onBehalfOf": { "userId": "user_01m4pc7v40fdm89vjt5k51b5h8", "name": "Ana Costa" }, "createdAt": "2026-11-01T15:00:00.000Z", "updatedAt": "2026-11-01T15:00:00.000Z" }, "secret": "whsec_ZXhhbXBsZS1zZWNyZXQtcm90YXRlZC0wMDAy"}Delete a webhook endpoint DELETE
Nothing more is sent to it, and its deliveries are deleted with it.
Send a test webhook POST
A delivery of type `webhook.test` sent now, signed as every delivery is, and its attempt in the answer. It is tried once, never retried, and shows in the deliveries. A disabled endpoint can be tested. A team sends up to 10 tests a minute; more answer 429.