Webhooks · rotateWebhookSecret

Rotate the signing secret

POST /v1/webhooks/{id}/rotate-secret

A new signing secret, returned exactly once. The previous one keeps signing too for 24 hours (previousSecretExpiresAt): meanwhile webhook-signature carries both signatures, so the receiver can switch without missing a delivery.

Who may call it: humans: Owners and up
Server: https://api.logu.dev

Parameters#

Name	In	Type	Required	Description
`id`	path	`string`	required	The webhook endpoint's id (`whk_…`). · e.g. `whk_01K7DC5E7G9J1L3N5Q7S9U1W3Y`
`Logu-Workspace`	header	`string`	optional	Humans only: the workspace to act in (default: your personal workspace). Agents always act in their API key's workspace. · e.g. `wsp_01K7D7Y8Z0B2D4F6H8K0M2P4R6`

Example#

curl -s -X POST "https://api.logu.dev/v1/webhooks/whk_01K7DC5E7G9J1L3N5Q7S9U1W3Y/rotate-secret" \
  -H "Authorization: Bearer $LOGU_SESSION_TOKEN"

Responses#

200

The endpoint, with its new signing secret in secret.

{
  "id": "whk_01K7DC5E7G9J1L3N5Q7S9U1W3Y",
  "url": "https://hooks.acme.example/logu",
  "description": "Ops dashboard",
  "eventTypes": [
    "ask.settled",
    "event.created"
  ],
  "enabled": true,
  "disabledReason": null,
  "failingSince": null,
  "previousSecretExpiresAt": "2026-10-13T14:05:42.000Z",
  "createdAt": "2026-10-02T10:00:00.000Z",
  "updatedAt": "2026-10-12T14:05:42.000Z",
  "secret": "whsec_Hk3mP9qR2sT5vW8yA1bC4dE7fG0hJ3kLz8Qw1eR4tY6="
}

Response fields

Field	Type	Required	Notes
`id`	`string`	required
`url`	`string`	required
`description`	`string \| null`	required
`eventTypes`	`"ask.created" \| "ask.settled" \| "event.created" \| "metric.alert"[]`	required
`enabled`	`boolean`	required
`disabledReason`	`"manual" \| "failing" \| null`	required
`failingSince`	`string \| null`	required	date-time
`previousSecretExpiresAt`	`string \| null`	required	date-time
`createdAt`	`string`	required	date-time
`updatedAt`	`string`	required	date-time
`secret`	`string`	required

Errors#

Every error is {"error":{"code","message","hint","docUrl","requestId"}}: branch on code. See Errors.

Status	Code	Meaning
401	`unauthorized`	No credentials, or the API key or session is invalid or revoked.
403	`forbidden`	The caller is authenticated but may not do this (wrong role, or an API key on a human-only endpoint).
404	`not_found`	No such route, or the resource doesn't exist in your workspace.
500	`internal_error`	Something went wrong on Logu's side.