Rotate vendor webhook subscription secret

Webhooks

POST/api/v1/scent/webhooks/{id}/rotate-secret

Generates a new server-side signing secret and returns it in THIS response ONLY — the previous secret stops verifying signatures immediately. No capability required — ownership is the only gate.

Path parameters

idstring (uuid)Required

Response

subscriptionIdstring (uuid)

secretstring

Shown EXACTLY ONCE.

Other responses

401No bearer token (UNAUTHORIZED_MISSING_TOKEN), an invalid token (UNAUTHORIZED_INVALID_TOKEN) or an expired one (UNAUTHORIZED_TOKEN_EXPIRED — mint a new token). UPSTREAM_AUTH_FAILED is different: a dependent service refused the Gateway itself. That is a server-side fault — retry later and do NOT re-mint your token. See the Rate limits & errors guide.

403The route is not available to your credential (FORBIDDEN).

404Unknown subscription id.

429Too many requests. Retry after the Retry-After header (seconds).

502A dependent service returned an invalid response (BAD_GATEWAY). Retry with backoff.

503The service is temporarily unavailable (SERVICE_UNAVAILABLE). Retry with backoff.

504A dependent service did not respond in time (GATEWAY_TIMEOUT). Retry with backoff.

cURL

curl --request POST \
  --url https://api-omni-vendors.linra.net/api/v1/scent/webhooks/5b1e3a1c-9d2e-4f3a-8b1c-9f0a2e3d4c5b/rotate-secret \
  --header 'Authorization: Bearer $TOKEN'

JavaScript

const res = await fetch('https://api-omni-vendors.linra.net/api/v1/scent/webhooks/5b1e3a1c-9d2e-4f3a-8b1c-9f0a2e3d4c5b/rotate-secret', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
  },
});
const { payload } = await res.json();

C#

var response = await httpClient.PostAsync("https://api-omni-vendors.linra.net/api/v1/scent/webhooks/5b1e3a1c-9d2e-4f3a-8b1c-9f0a2e3d4c5b/rotate-secret", null);

var envelope = await response.Content.ReadFromJsonAsync<ApiResponse<VendorWebhookSecretRotatedResponse>>();

Response

{
  "state": "SUCCESS",
  "payload": {
    "subscriptionId": "5b1e3a1c-9d2e-4f3a-8b1c-9f0a2e3d4c5b",
    "secret": "string"
  },
  "details": null
}