Rotate the signing secret
/api/v2/webhooks/{id}/rotate-secretReplaces the secret. The response carries the new secret once. For 24 hours, deliveries carry a signature with the old secret and one with the new, so you can deploy the new secret without dropping events. Needs webhooks:write.
id*stringId of a webhook: webhook_ followed by its key.
^webhook_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$idempotency-key?stringClient-chosen key, 1 to 255 characters (a UUID is recommended). The same key on the same endpoint within 24 hours replays the stored response with Idempotent-Replayed: true.
1 <= length <= 255Webhook
application/json- response
object*"webhook"Type of the object. Always webhook.
"webhook"id*WebhookIdId of a webhook: webhook_ followed by its key.
^webhook_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$url*stringWhere Talentir sends the events: a public https URL. Private and reserved hosts are refused.
urilength <= 2048events*array<string>The events the webhook receives, as you subscribed them, wildcards included.
enabled*booleanWhether Talentir delivers events. Talentir sets it to false after too many failed deliveries in a row.
secret*|The signing secret: whsec_ followed by the base64 key, as Standard Webhooks defines it. Present only in the response of create and rotate-secret. null everywhere else.
createdAt*stringWhen the webhook was created.
date-timeupdatedAt*stringWhen the webhook was last updated.
date-timecurl -X POST 'https://www.talentir.com/api/v2/webhooks/webhook_0e4ba886-0bfe-4b6a-ae2e-d6d9d135dd1e/rotate-secret'{ "object": "webhook", "id": "webhook_0e4ba886-0bfe-4b6a-ae2e-d6d9d135dd1e", "url": "https://example.com/done", "events": [ "string" ], "enabled": true, "secret": "string", "createdAt": "2026-09-24T10:00:00.000Z", "updatedAt": "2026-09-24T10:00:00.000Z"}