Runs examples for real against your account. Test keys only; kept in this tab, never stored on our side. Get a key
ZapSMTP / Docs / Webhooks

Rotate the signing secret

POST/v1/webhooks/{id}/rotate-secret

Generate a new signing secret; the old one stays valid for 24 hours.

Requires a full-access live key; test keys get 403 test_key_restricted.

During the grace period Zap-Signature carries two v1= entries (new secret first). Rotating again replaces the previous secret.

Path parameters

idstringrequired
Webhook id

Errors

restricted_api_keyHTTP 403
test_key_restrictedHTTP 403
test-mode keys can send test email and read, not change the account: use a live key
not_foundHTTP 404
webhook not found
POST/v1/webhooks/{id}/rotate-secret
curl -X POST 'https://zapsmtp.xyz/v1/webhooks/019a1c55-0d6e-7f21-8b3a-5e9d4c7b2a10/rotate-secret' \
  -H "Authorization: Bearer $ZAP_API_KEY"
Set ZAP_API_KEY in your environment.
Response 200 OK
{
  "object": "webhook",
  "id": "019a1f22-6e7f-7091-8a2b-3c4d5e6f7a8b",
  "secret": "whsec_R2m8Kx5Vq1Lb7Tn4Zw9Pc3Hj6Fd0Gs8Y",
  "previous_secret_expires_at": "2026-10-22T15:45:00Z"
}