Rotate Dropship Webhook Secret
POST/api/admin/portal/accounts/:customer/webhooks/:webhook/rotate-secret
Issue a new signing secret for the endpoint. The old secret stops working immediately — every delivery from now on, including retries of earlier events, is signed with the new one. The new secret is returned once and never again. Requires the portal.manage permission. No request body.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Errors. 404 when the webhook does not belong to the account.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.