Skip to main content
POST
cURL
Ends the staged dual-signature overlap and removes the previous signing secret from future delivery authorization. Call it after your receiver has completed its rollout. The operation is idempotent. Calling it when no previous secret remains returns the endpoint with secret_rotation.status idle and does not return signing_secret.

Rotation status

Example

What it does not do

  • Change the current signing secret. Use Rotate a webhook secret for immediate replacement.
  • Resend deliveries or change the endpoint URL.
  • Return either stored secret. Future deliveries authorize only the current secret.

Authorizations

Authorization
string
header
required

API key or OAuth 2.1 access token in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

Idempotency-Key
string

Optional safe-retry key. Reuse the same value only when retrying the exact same mutation request body; a different body returns 422 and an in-flight matching request returns 409.

Required string length: 1 - 255

Path Parameters

id
integer<int64>
required

Webhook endpoint id owned by the authenticated API key user.

Response

Webhook destination after the previous signing secret is retired

object
string
required
Allowed value: "webhook"
data
object
required
meta
object
required