Regenerate Webhook Secret

Generate a new signing secret for a webhook. Use this if you believe your secret has been compromised.

Endpoint

POST /v1/webhooks/{id}/regenerate-secret

Authentication

Requires an API key with the webhooks:write scope.

Parameters

Parameter	Type	Location	Description
id	integer	path	The webhook ID

Example Request

curl -X POST "https://app.equipdash.com/api/v1/webhooks/3/regenerate-secret" \
  -H "Authorization: Bearer eqd_live_abc123xyz789..."

Response

Success (200 OK)

{
  "data": {
    "secret": "new_secret_xyz789abc123...",
    "message": "Webhook secret has been regenerated. Please update your endpoint to use the new secret."
  },
  "meta": {
    "request_id": "req_abc123",
    "timestamp": "2026-01-15T12:00:00+00:00"
  }
}

Update Your Endpoint

After regenerating the secret, you must immediately update your webhook endpoint to use the new secret. Any webhook deliveries using the old secret will fail signature verification.

Errors

Status	Code	Description
401	authentication_required	No API key provided
401	invalid_api_key	Invalid API key
403	insufficient_scope	API key lacks webhooks:write scope
403	forbidden	Webhook belongs to different supplier
404	resource_not_found	Webhook does not exist

Security Best Practices

1. Rotate secrets periodically - Even without a compromise, rotating secrets is good security hygiene
2. Store secrets securely - Use environment variables or a secrets manager
3. Update immediately - After regenerating, update your endpoint right away to avoid missing events
4. Verify all signatures - Always verify webhook signatures before processing