curl --request POST \
--url https://hpay-api.host-sl.com/api/v1/webhooks/subscriptions/7c1d2e3f-.../rotate-secret \
--header 'api-key: YOUR_API_KEY' \
--header 'secret-key: YOUR_SECRET_KEY'
from hostpay import HostPay
client = HostPay(api_key="YOUR_API_KEY", secret_key="YOUR_SECRET_KEY")
rotated = client.webhooks.subscriptions.rotate_secret("7c1d2e3f-...")
store_secret(rotated["secret"]) # shown once!
import { HostPay } from "@hostpay/sdk";
const client = new HostPay({ apiKey: "YOUR_API_KEY", secretKey: "YOUR_SECRET_KEY" });
const rotated = await client.webhooks.subscriptions.rotateSecret("7c1d2e3f-...");
storeSecret(rotated.secret); // shown once!
{
"id": "a1b2c3d4-...",
"secret": "whsec_new5e6f7...",
"secret_preview": "...7Xw2",
"rotated_from_id": "9z8y7x6w-..."
}
{
"detail": "Subscription not found"
}
Webhook Subscriptions
Rotate Signing Secret
Replace a subscription’s signing secret.
POST
/
api
/
v1
/
webhooks
/
subscriptions
/
{subscription_id}
/
rotate-secret
curl --request POST \
--url https://hpay-api.host-sl.com/api/v1/webhooks/subscriptions/7c1d2e3f-.../rotate-secret \
--header 'api-key: YOUR_API_KEY' \
--header 'secret-key: YOUR_SECRET_KEY'
from hostpay import HostPay
client = HostPay(api_key="YOUR_API_KEY", secret_key="YOUR_SECRET_KEY")
rotated = client.webhooks.subscriptions.rotate_secret("7c1d2e3f-...")
store_secret(rotated["secret"]) # shown once!
import { HostPay } from "@hostpay/sdk";
const client = new HostPay({ apiKey: "YOUR_API_KEY", secretKey: "YOUR_SECRET_KEY" });
const rotated = await client.webhooks.subscriptions.rotateSecret("7c1d2e3f-...");
storeSecret(rotated.secret); // shown once!
{
"id": "a1b2c3d4-...",
"secret": "whsec_new5e6f7...",
"secret_preview": "...7Xw2",
"rotated_from_id": "9z8y7x6w-..."
}
{
"detail": "Subscription not found"
}
Generates a new signing secret for the subscription and retires the old one. Update your endpoint’s verification secret immediately after rotating.
The new
secret is returned only in this response — store it before
discarding the old one.Path Parameters
string
required
The subscription whose secret to rotate.
Response
string
The new secret’s ID.
string
The new signing secret — shown once.
string
The last few characters, for identification.
string
The ID of the secret this one replaced.
{
"id": "a1b2c3d4-...",
"secret": "whsec_new5e6f7...",
"secret_preview": "...7Xw2",
"rotated_from_id": "9z8y7x6w-..."
}
{
"detail": "Subscription not found"
}
curl --request POST \
--url https://hpay-api.host-sl.com/api/v1/webhooks/subscriptions/7c1d2e3f-.../rotate-secret \
--header 'api-key: YOUR_API_KEY' \
--header 'secret-key: YOUR_SECRET_KEY'
from hostpay import HostPay
client = HostPay(api_key="YOUR_API_KEY", secret_key="YOUR_SECRET_KEY")
rotated = client.webhooks.subscriptions.rotate_secret("7c1d2e3f-...")
store_secret(rotated["secret"]) # shown once!
import { HostPay } from "@hostpay/sdk";
const client = new HostPay({ apiKey: "YOUR_API_KEY", secretKey: "YOUR_SECRET_KEY" });
const rotated = await client.webhooks.subscriptions.rotateSecret("7c1d2e3f-...");
storeSecret(rotated.secret); // shown once!