API reference
Rotate signing secret
New secret, optional grace period.
POST
/webhooks/:id/rotate-secretReturns a new secret once. With a grace period, deliveries are signed with both secrets until it ends.
- Permission
- write:webhooks
- Auth
- api-key
- Idempotent
- No
- Language
- Node.js
| Field | In | Type | Required | Description |
|---|---|---|---|---|
| expiresPreviousSecretInHours | body | number | No · 0 | 0–168. Keep signing with the old secret this long. |
const response = await fetch(`${process.env.BOSPAY_API_BASE}/webhooks/we_example/rotate-secret`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"BOSPay-Version": "2026-09-23",
"X-API-Key": process.env.BOSPAY_API_KEY,
},
body: JSON.stringify({
"expiresPreviousSecretInHours": 24
})
});
if (!response.ok) {
throw new Error(`BOSPay request failed: ${response.status}`);
}
const data = await response.json();Success
200
{
"id": "we_example",
"object": "webhook_endpoint",
"url": "https://merchant.example/webhooks/bospay",
"events": [
"invoice.paid",
"invoice.payment_detected",
"invoice.partial"
],
"environment": "sandbox",
"status": "enabled",
"secret": "whsec_… (returned once)"
}Validation error
400
{
"error": {
"type": "invalid_request_error",
"code": "validation_error",
"message": "A valid fiatAmount is required.",
"field": "fiatAmount",
"requestId": "req_3f0c9a1b2c4d5e6f7a8b9c0d"
}
}