Skip to main content
POST
cURL
Promotes the prepared signing secret to current and returns it once. For one hour after activation, each delivery carries a signature from both the new and previous secret so the receiver can finish its rollout without dropped traffic. Call Retire a staged webhook secret after the receiver accepts the new secret. The operation honors Idempotency-Key.

Rotation status

During overlap, x-0xinsider-signature contains comma-separated v1=<hex> candidates. Verify the timestamp and raw body against each candidate and accept the request when one verifies.

Example

Handle a 409

What it does not do

  • Retire the previous secret immediately. The overlap ends when you call retire or when its expiry passes.
  • Send a verification challenge. The endpoint remains in its existing status.
  • Return the previous secret. It is used only to generate the bounded overlap signature.

Authorizations

Authorization
string
header
required

API key or OAuth 2.1 access token in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

Idempotency-Key
string

Optional safe-retry key. Reuse the same value only when retrying the exact same mutation request body; a different body returns 422 and an in-flight matching request returns 409.

Required string length: 1 - 255

Path Parameters

id
integer<int64>
required

Webhook endpoint id owned by the authenticated API key user.

Response

Webhook destination with the activated signing secret

object
string
required
Allowed value: "webhook"
data
object
required
meta
object
required