Rotate Webhook Secret
curl --request POST \
--url https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret \
--header 'X-Api-Key: <x-api-key>'import requests
url = "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
headers = {"X-Api-Key": "<x-api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Api-Key': '<x-api-key>'}};
fetch('https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Api-Key: <x-api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Api-Key", "<x-api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
.header("X-Api-Key", "<x-api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Api-Key"] = '<x-api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
Webhooks API
Rotate Webhook Secret
Generate a new signing secret for a webhook
POST
/
public
/
v1
/
webhooks
/
{id}
/
rotate-secret
Rotate Webhook Secret
curl --request POST \
--url https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret \
--header 'X-Api-Key: <x-api-key>'import requests
url = "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
headers = {"X-Api-Key": "<x-api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Api-Key': '<x-api-key>'}};
fetch('https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Api-Key: <x-api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Api-Key", "<x-api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
.header("X-Api-Key", "<x-api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.pro.daya.co/public/v1/webhooks/{id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Api-Key"] = '<x-api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
Overview
Generate a new signing secret for a webhook. The old secret becomes invalid immediately. The new secret is only returned once, so make sure to store it securely.Pro webhook setup and secret rotation are support-managed. Contact support@daya.co if you need to rotate a webhook signing secret for your Pro account.
Authentication
Your API key with Write scope
X-Api-Key: daya_sk_YOUR_API_KEY
Path Parameters
Webhook ID (UUID)Example:
770e8400-e29b-41d4-a716-446655440000Request Examples
curl --request POST \
--url 'https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret' \
--header 'X-Api-Key: daya_sk_YOUR_API_KEY'
const webhookId = '770e8400-e29b-41d4-a716-446655440000';
const response = await fetch(
`https://api.pro.daya.co/public/v1/webhooks/${webhookId}/rotate-secret`,
{
method: 'POST',
headers: { 'X-Api-Key': 'daya_sk_YOUR_API_KEY' }
}
);
const data = await response.json();
// IMPORTANT: Store the new secret securely - it's only shown once!
console.log('New secret:', data.data.secret);
import requests
webhook_id = '770e8400-e29b-41d4-a716-446655440000'
headers = {'X-Api-Key': 'daya_sk_YOUR_API_KEY'}
response = requests.post(
f'https://api.pro.daya.co/public/v1/webhooks/{webhook_id}/rotate-secret',
headers=headers
)
result = response.json()
# IMPORTANT: Store the new secret securely - it's only shown once!
print(f"New secret: {result['data']['secret']}")
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
req, _ := http.NewRequest("POST", "https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret", nil)
req.Header.Set("X-Api-Key", "daya_sk_YOUR_API_KEY")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
var result map[string]interface{}
json.NewDecoder(resp.Body).Decode(&result)
// IMPORTANT: Store the new secret securely - it's only shown once!
fmt.Println("New secret:", result["data"])
}
Response
Indicates if the request was successful
Human-readable response message
Webhook with new secret
Show webhook properties
Show webhook properties
Unique webhook identifier (UUID)
Webhook endpoint URL
Webhook description
Events this webhook is subscribed to
Webhook status:
active, paused, disabledNew signing secret for verifying webhook payloads.
This is only returned once. Store it securely!
ISO 8601 creation timestamp
ISO 8601 last update timestamp
Success Response
{
"success": true,
"message": "Webhook secret rotated successfully",
"data": {
"id": "770e8400-e29b-41d4-a716-446655440000",
"url": "https://example.com/webhooks/daya",
"description": "Order notifications",
"events": ["order.filled", "order.cancelled"],
"status": "active",
"secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
"failure_count": 0,
"last_success_at": "2024-01-15T10:30:00Z",
"last_failure_at": null,
"last_failure_reason": null,
"created_at": "2024-01-01T00:00:00Z",
"updated_at": "2024-01-15T12:00:00Z"
},
"timestamp": "2024-01-15T12:00:00Z"
}
The
secret is a 64-character hex string (32 bytes). This is the raw secret used for HMAC-SHA256 signature verification.Error Responses
{
"success": false,
"message": "Validation error",
"error": {
"code": "VALIDATION_ERROR",
"message": "Invalid webhook ID format"
}
}
{
"success": false,
"message": "Webhook not found",
"error": {
"code": "WEBHOOK_NOT_FOUND",
"message": "No webhook found with the specified ID"
}
}
{
"success": false,
"message": "Unauthorized",
"error": {
"code": "API_KEY_INVALID",
"message": "The provided API key is invalid"
}
}
The old secret becomes invalid immediately. After rotating, update your webhook verification code with the new secret before processing any new webhook deliveries.
Rate Limits
- 100 requests per minute per API key
Next Steps
Webhook Verification
Learn how to verify webhook signatures
Get Webhook
View webhook details
⌘I