Rotate the signing secret

POST /api/v1/webhook_subscriptions/{id}/rotate_secret

webhooks:write

Generates a new signing_secret (returned once, in this response) and preserves the previous one for 24 hours so deliveries during your deploy window ship with both v1= (new) and v0= (old) signatures. After the grace window only v1= ships. Requires webhooks:write.

Path parameters

Name	Type	Description
`id`required	integer	Webhook subscription id. Scoped to the calling api_client.

Responses

200 New signing_secret returned (one-time) application/json

data WebhookSubscription

Schema: WebhookSubscriptionWithSecret
- id integer
- object string
- url string
- event_filter array of WebhookEventName Empty = subscribed to ALL events.
- active boolean
- last_delivered_at string (date-time), nullable
- created_at string (date-time)
- updated_at string (date-time)
- signing_secret string
meta Meta

Schema: Meta
- request_id string required Correlation id for this request. Also sent as the `X-Request-Id` response header; quote it when contacting support.

200 example

{
  "data": {
    "id": 1,
    "object": "webhook_subscription",
    "url": "https://hooks.partner.example/cascades",
    "event_filter": [
      "execution.completed"
    ],
    "active": true,
    "last_delivered_at": "2026-05-08T18:41:05Z",
    "created_at": "2026-05-08T18:41:05Z",
    "updated_at": "2026-05-08T18:41:05Z",
    "signing_secret": "whsec_4f1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9"
  },
  "meta": {
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f"
  }
}

401 Missing, malformed, expired or revoked bearer token. The WWW-Authenticate header carries the RFC 6750 challenge. application/json

Schema: ErrorEnvelope

401 example

{
  "error": {
    "code": "unauthorized",
    "message": "A valid bearer token is required.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/unauthorized"
  }
}

403 Token does not hold the required scope. details lists the scope(s) that were checked. application/json

Schema: ErrorEnvelope

403 example

{
  "error": {
    "code": "insufficient_scope",
    "message": "This token does not have the required scope.",
    "details": [
      {
        "field": "scope",
        "message": "executions:write"
      }
    ],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope"
  }
}

404 Resource does not exist or belongs to another tenant / api_client application/json

Schema: ErrorEnvelope

404 example

{
  "error": {
    "code": "not_found",
    "message": "The requested resource was not found.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/not_found"
  }
}

429 Rate limit exceeded (60 req/min per IP on /api/v1, 600 req/hour per token prefix, or 300 req/5 min per IP globally). The body is the standard error envelope and Retry-After gives the seconds until the window resets. application/json

Schema: ErrorEnvelope

429 example

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Retry later.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/rate_limited"
  }
}

Markdown version · OpenAPI

Path parameters

Responses

Related