Skip to content
Crossmart Docs

Give a webhook endpoint a new signing secret, returned once

POST
/api/v1/workspaces/{workspaceId}/webhook-endpoints/{endpointId}/rotate-secret
curl --request POST \
  --url https://api.crossmart.io/api/v1/workspaces/example/webhook-endpoints/example/rotate-secret \
  --header 'x-api-key: <x-api-key>'

For 24 hours deliveries are signed with both the new and the old secret (two v1 signatures), so the receiver can switch without dropping events.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
workspaceId
required
string
endpointId
required
string

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json
object
endpoint
required
object
id
required
string format: uuid
url
required
string
description
required
string
nullable
eventTypes
required
Array<string>
Allowed values: order.created order.updated inventory.stock_changed listing.published listing.failed listing.removed product.created product.updated product.deleted webhook.test
enabled
required

False when turned off by someone or after repeated failures

boolean
disabledReason
required

MANUAL: turned off by someone. FAILING: turned off by Crossmart.

string
Allowed values: MANUAL FAILING
disabledAt
required
string format: date-time
nullable
consecutiveFailures
required

Failed attempts since the last delivery that went through

number
lastDelivery
required

The latest delivery attempt, whatever event it carried; null before the first

object
attemptedAt
required
string format: date-time
outcome
required

SUCCEEDED: the endpoint answered 2xx. FAILED: anything else, or no answer.

string
Allowed values: SUCCEEDED FAILED
responseStatus
required

Null when no response came: a timeout or a connection error

number
nullable
error
required

Why the attempt failed; null on success

string
nullable
previousSecretExpiresAt
required

Until then deliveries are also signed with the secret the last rotation replaced

string format: date-time
nullable
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
secret
required

The signing secret. Shown once; store it now.

string

Example 

{
  "endpoint": {
    "url": "https://example.com/crossmart/webhooks",
    "description": "Order notifications to n8n",
    "eventTypes": [
      "order.created"
    ],
    "disabledReason": "MANUAL",
    "lastDelivery": {
      "outcome": "SUCCEEDED",
      "responseStatus": 200,
      "error": "The endpoint answered with HTTP 503"
    }
  },
  "secret": "whsec_3q2-7wEXAMPLEsecretVALUE0123456789abcdef"
}

503

Section titled “503”

The server has no CREDENTIALS_MASTER_KEY to encrypt secrets with