Issue a new HMAC secret, keeping the previous one briefly valid

post

https://api.qfp.quantnetwork.net/api/webhooks/{id}/secret/rotate

Generates a new shared secret for an HMAC_SHA256 registration and returns it once. The previous secret keeps working for an overlap window, and both signatures are sent on every delivery until it expires, so deliveries continue to verify while the new secret is deployed. previousSecretExpiresAt is the deadline for deploying it.

The window is 24 hours by default. Rotating twice inside the window retires the older secret immediately. Only one previous secret is ever held. A JWS_ES256 registration returns 404 Not Found, since that scheme has no shared secret to rotate.

Path Params

uuid

required

The registration's identifier.

Headers

API-Version

string

required

^\d+\.\d+\.\d+$

The version of the Quant Flow API the request follows, as major.minor.patch (for example 1.0.0). The request is interpreted, and the response shaped, according to that version.

Idempotency-Key

string

required

Caller-supplied key making the write at-most-once. Required on every POST and PATCH; DELETE does not take one. A missing or blank header returns 400.
Replaying a key whose first request has finished returns that first response unchanged, with Idempotency-Replayed: true and the original Location where there was one. Sending a different body under the same key also returns the first response; the new body is ignored.
While the first request is still running, the same key returns 409 Conflict.
A key is only held once the request has succeeded. A write that fails releases it, so the same key can be used again for a retry.
A key is scoped to the caller and the operation: the organisation, the user, the HTTP method and the request path. The same value sent to a different endpoint, or by a different user in the same organisation, is a new request rather than a replay. There is no length limit.

Responses

Language

Credentials

Bearer

JWT

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Rotated. The body carries the new secret; no other response will.

400The request failed validation. message names the offending field rather than the specific constraint.

401Returned once authentication is enforced, when the request carries no Authorization header or an unresolvable token. (planned — not returned today, see the API description.)

404No registration exists with that identifier, or it has been deleted.

409An earlier request with the same Idempotency-Key is still running. Retry once it has finished.

500An unexpected error occurred while handling the request.