Rotate webhook secret

rotate_webhook_secret Add a second active signing secret, or retire the older one. Both secrets sign every request while two are active, so a receiver updates its configuration whenever it likes rather than deploying in lockstep with us. The new secret is returned ONCE.

Available in the deployed MCP and HTTP bundle. Confirm access and inputs with your connected catalog. Workspace scopes and enabled providers still apply.

Access	Behavior
`watches:write`	Writes or admits work; can change or remove existing state

This operation changes saved state. Review its inputs and retry behavior before calling.

Example request

Connect through MCP, CLI, or HTTP. Replace example identifiers with records from your workspace.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "rotate_webhook_secret",
    "arguments": {
      "endpointId": "endpoint_example"
    }
  }
}

agentlinkops call rotate_webhook_secret --args '{"endpointId":"endpoint_example"}'

curl "$AGENTLINKOPS_API_URL/v1/commands/rotate_webhook_secret" \
  -H "Authorization: Bearer $AGENTLINKOPS_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"endpointId":"endpoint_example"}'

Returned result

Illustrative data validated against the documented response schema. IDs and dates are examples, not a live account capture. MCP returns this data in structuredContent and in a text content block; generic HTTP and CLI return the JSON result directly.

{
  "id": "endpoint_example",
  "active_secrets": 2,
  "retired": false,
  "secret": "whsec_example_not_a_credential"
}

Input fields

Omit optional fields when you do not want to supply them. Null is accepted only where listed. Unknown input properties are rejected.

Field	Type	Presence	Meaning and constraints
`endpointId`	string	Required	Identifier of the endpoint returned by its create or list operation. minLength: 1; maxLength: 200
`retire`	boolean	Optional	First call with false to issue a new secret, save it and update the receiver. Then call with true to retire the older secret; true alone never rotates. default: false

Validation and omitted values

With retire omitted or false, add a new secret. Store and test it before calling with retire:true to remove the older secret. Both secrets sign during overlap.

Defaults when omitted

Field	Default
`retire`	`false`

Output fields

Fields inside optional or nullable parents apply only when that parent exists. Common schema conventions explain evidence states, empty lists and extensions.

Field	Type	Presence	Meaning and constraints
`id`	string	Required	Resource identifier returned by the operation.
`active_secrets`	number	Required
`retired`	boolean	Required
`secret`	string	Optional	Webhook signing secret returned only when created or rotated. Store it securely.

Download input schema · Download output schema

Errors and retries

This command is not annotated idempotent. After a timeout, inspect existing state before repeating a write. See error recovery for status, scope, cooldown, cursor and retry handling. Unknown observations are result data and do not establish loss.

HTTP resource routes

These existing resource routes share the operation’s domain behavior. Their parameter placement, status and response envelope can differ from generic invocation. See HTTP route details.

Method and route	Success	Details
`POST /v1/webhooks/{endpointId}/secrets`	201	Remaining arguments go in a JSON object body. Empty or unreadable body is treated as {} by this resource handler; use {retire:true} to retire the older secret.

Continue

list_webhooks Follow the related workflow, inspect capability status, or return to the command index.

Overview

MCP, CLI and API commands

CLI client

HTTP and events

Optional local workflows

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue

​Example request

​Returned result

​Input fields

​Validation and omitted values

​Defaults when omitted

​Output fields

​Errors and retries

​HTTP resource routes

​Continue

Example request

Returned result

Input fields

Validation and omitted values

Defaults when omitted

Output fields

Errors and retries

HTTP resource routes

Continue