Rotate Webhook Secret
curl --request POST \
--url https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret \
--header 'X-Api-Key: <x-api-key>'import requests
url = "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
headers = {"X-Api-Key": "<x-api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Api-Key': '<x-api-key>'}};
fetch('https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Api-Key: <x-api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Api-Key", "<x-api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
.header("X-Api-Key", "<x-api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Api-Key"] = '<x-api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
Webhooks API
Rotate Webhook Secret
Generate a new signing secret for a webhook
POST
/
public
/
v1
/
webhooks
/
{id}
/
rotate-secret
Rotate Webhook Secret
curl --request POST \
--url https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret \
--header 'X-Api-Key: <x-api-key>'import requests
url = "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
headers = {"X-Api-Key": "<x-api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Api-Key': '<x-api-key>'}};
fetch('https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Api-Key: <x-api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Api-Key", "<x-api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
.header("X-Api-Key", "<x-api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Api-Key"] = '<x-api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
Overview
Generate a new signing secret for a webhook. The old secret becomes invalid immediately. The new secret is only returned once, so make sure to store it securely.Pro webhook setup and secret rotation are support-managed. Contact support@daya.co if you need to rotate a webhook signing secret for your Pro account.
Authentication
string
required
Your API key with Write scope
X-Api-Key: daya_sk_YOUR_API_KEY
Path Parameters
string
required
Webhook ID (UUID)Example:
770e8400-e29b-41d4-a716-446655440000Request Examples
curl --request POST \
--url 'https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret' \
--header 'X-Api-Key: daya_sk_YOUR_API_KEY'
const webhookId = '770e8400-e29b-41d4-a716-446655440000';
const response = await fetch(
`https://api.pro.daya.co/public/v1/webhooks/${webhookId}/rotate-secret`,
{
method: 'POST',
headers: { 'X-Api-Key': 'daya_sk_YOUR_API_KEY' }
}
);
const data = await response.json();
// IMPORTANT: Store the new secret securely - it's only shown once!
console.log('New secret:', data.data.secret);
import requests
webhook_id = '770e8400-e29b-41d4-a716-446655440000'
headers = {'X-Api-Key': 'daya_sk_YOUR_API_KEY'}
response = requests.post(
f'https://api.pro.daya.co/public/v1/webhooks/{webhook_id}/rotate-secret',
headers=headers
)
result = response.json()
# IMPORTANT: Store the new secret securely - it's only shown once!
print(f"New secret: {result['data']['secret']}")
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
req, _ := http.NewRequest("POST", "https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret", nil)
req.Header.Set("X-Api-Key", "daya_sk_YOUR_API_KEY")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
var result map[string]interface{}
json.NewDecoder(resp.Body).Decode(&result)
// IMPORTANT: Store the new secret securely - it's only shown once!
fmt.Println("New secret:", result["data"])
}
Response
boolean
required
Indicates if the request was successful
string
required
Human-readable response message
object
required
Webhook with new secret
Show webhook properties
Show webhook properties
string
Unique webhook identifier (UUID)
string
Webhook endpoint URL
string
Webhook description
array
Events this webhook is subscribed to
string
Webhook status:
active, paused, disabledstring
New signing secret for verifying webhook payloads.
This is only returned once. Store it securely!
string
ISO 8601 creation timestamp
string
ISO 8601 last update timestamp
Success Response
{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
The
secret is a 64-character hex string (32 bytes). This is the raw secret used for HMAC-SHA256 signature verification.Error Responses
{
"success": false,
"message": "Validation error",
"error": {
"code": "VALIDATION_ERROR",
"message": "Invalid webhook ID format"
}
}
{
"success": false,
"message": "Webhook not found",
"error": {
"code": "WEBHOOK_NOT_FOUND",
"message": "No webhook found with the specified ID"
}
}
{
"success": false,
"message": "Unauthorized",
"error": {
"code": "API_KEY_INVALID",
"message": "The provided API key is invalid"
}
}
The old secret becomes invalid immediately. After rotating, update your webhook verification code with the new secret before processing any new webhook deliveries.
Rate Limits
- 100 requests per minute per API key
Next Steps
Webhook Verification
Learn how to verify webhook signatures
Get Webhook
View webhook details
⌘I