Skip to main content
POST
cURL
Use this when the secret has leaked and the old one has to stop working immediately. For a planned rotation with no rejected deliveries, use the staged path instead: Prepare a staged webhook secret, then Activate a staged webhook secret, then Retire a staged webhook secret.

Parameters

What rotation changes

Deploy the new secret to your receiver before the next delivery. A delivery your receiver rejects with a 401 or 403 is retried 60 seconds later, and it counts toward the 8 consecutive failures that disable the endpoint.

Example

Handle a 409 or a 422

A retry with the same Idempotency-Key returns the first response, which means the same secret again. Keep that response out of your logs.

What it does not do

  • Return the secret later. Webhook and Webhooks never carry it, so if you lose it your only option is to rotate again.
  • Sign anything with the old secret. Every attempt after this call carries one signature, from the new secret.
  • Give your receiver a handover window. That is what Activate a staged webhook secret is for.
  • Resend anything. Watch Webhook deliveries for the first attempts signed with the new secret.

Authorizations

Authorization
string
header
required

Legacy default or named integration API key, or OAuth 2.1 access token, in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Default keys retain full access; integration keys are limited to their approved read, webhooks, export and usage scopes and expire within 90 days. All credentials share the owner's account limits. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

X-Query-Validation
enum<string>

Opt into strict query-name validation. The default is compatible: unknown names are ignored and reported in X-Query-Ignored. With strict, an unknown name returns 400 bad_request with error.reason unknown_query_parameter before the handler runs, including when its percent escape is incomplete.

Available options:
strict
Idempotency-Key
string

Optional safe-retry key. Reuse the same value only when retrying the exact same mutation request body; a different body returns 422 and an in-flight matching request returns 409.

Required string length: 1 - 255

Path Parameters

id
integer<int64>
required

Webhook endpoint id owned by the authenticated API key user.

Response

Webhook destination

object
string
required
Allowed value: "webhook"
data
object
required
meta
object
required