Rotate the signing secret for a webhook endpoint
Generate a new signing secret for a webhook endpoint, invalidating the old one. The new secret is returned once in this response.
Authorization
BearerAuth AuthorizationBearer <token>
Medblocks API key for server-side requests.
In: header
Path Parameters
id*string
Webhook endpoint id (wh_*).
Header Parameters
Version?string
Date-pinned API version. If omitted, Medblocks uses the version pinned on your API key.
Response Body
application/json
application/json
curl -X POST "https://example.com/webhooks/string/rotate-secret" \ -H "Version: 2026-04-25"{ "id": "wh_01J9YR9N3X4VZ6P2K5RH7M3LMP", "resource_type": "webhook_endpoint", "url": "https://api.fhirapp.com/medblocks/webhook", "events": [ "patient_session.completed", "connection.token_refresh_failed" ], "status": "active", "description": "Production webhook", "metadata": {}, "api_version": "2026-04-25", "created_at": "2026-04-25T14:30:00.000Z", "updated_at": "2026-04-25T14:30:00.000Z", "secret": "whsec_01J9YR9N3X4VZ6P2K5RH7M3LMPabcdef0123456789abcdef0123456789"}{ "error": { "type": "authentication_error", "code": "invalid_api_key", "message": "API key invalid", "param": null, "doc_url": "https://docs.medblocks.com/errors/invalid_api_key", "request_id": "9c9b6f7a-8e4f-4a3b-9c1e-6f3a2d8b7c4d" }}Non-2xx responses use the standard API error envelope. Log
error.code and error.request_id for support.Delete a webhook endpoint DELETE
Permanently delete a webhook endpoint and its delivery history. Returns a tombstone confirming the deletion.
List recent webhook events for an endpoint GET
List recent delivery records for one endpoint with cursor pagination and an optional delivered filter for the delivery audit.