GetItDoneGetItDone Docs
API ReferenceWebhook endpoints

Rotate a webhook endpoint secret

POST
/v1/webhook-endpoints/{endpoint_id}/rotate-secret

Create-overlap-revoke rotation: mints a NEW signing secret (returned ONCE, same as create) and moves the CURRENT secret to previous_secret_expires_at-bounded overlap — the worker signs every delivery with BOTH secrets during that ~24h window so you can finish updating your verifier without dropping deliveries. Rotating a SECOND time before the first rotation's grace window elapses immediately drops the FIRST previous secret (there is only ever one previous-secret slot, not a stack) — do not chain rotations faster than your own verifier can keep up. Never mutates a secret in place; always mints fresh. Supports the optional Idempotency-Key header (a replay returns the SAME newly-minted secret again, never rotates twice for one logical request).

Authorization

bearerAuth
headerAuthorizationBearer <token>

A gid_ API key (Profile → API Keys) or an OAuth 2.1 access token.

Path Parameters

endpoint_id*string

Header Parameters

Idempotency-Key?string

Optional client-generated key (1-255 visible ASCII characters; a UUID works) making this POST safely retryable. Retrying with the SAME key and byte-identical body within 24h replays the stored first response (marked Idempotency-Replayed: true, never re-executed, never charged against quota). The same key with a different body answers 422 idempotency_key_reused; a retry racing the first execution answers 409 idempotency_in_progress. Omitting the header executes normally with no idempotency guarantee.

Length1 <= length <= 255

Response Body

The endpoint with its newly rotated secret.

application/json
  1. response

Result of a create-overlap-revoke secret rotation. Rotating a SECOND time before the first rotation's grace window elapses immediately drops the FIRST previous secret — there is only ever one previous-secret slot, not a stack.

id*string

Stable id of the endpoint.

url*string

The https destination URL.

enabled*boolean

False when disabled — manually, auto-disabled after repeated delivery failures, or paused when the account that set it up had its email address verified (see disabled_reason). A disabled endpoint receives nothing: deliveries already queued for it are held, not sent, and go out only if it is re-enabled.

event_types*array<>

Subscribed event types. An EMPTY array means "every type".

verified*boolean

True once the verify action has proven this endpoint accepts a correctly-signed request.

disabled_reason*|

Why the endpoint was auto-disabled or paused by an account take-back, or null when it never was.

created_at*string

ISO-8601 UTC.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
updated_at*string

ISO-8601 UTC.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
secret*string

The NEW signing secret — shown EXACTLY ONCE.

previous_secret_expires_at*string

The prior secret keeps signing outgoing deliveries alongside the new one until this time (~24h out) — dual-secret acceptance so you can finish updating your verifier before the old secret dies.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
Example Request
curl -X POST 'https://app.nowgetitdone.com/v1/webhook-endpoints/string/rotate-secret'
Example Response
{  "id": "string",  "url": "string",  "enabled": true,  "event_types": [    "task.created"  ],  "verified": true,  "disabled_reason": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "secret": "whsec_51f3...redacted",  "previous_secret_expires_at": "2019-08-24T14:15:22Z"}

Delete a webhook endpoint DELETE

Permanently (hard) deletes the endpoint — org-scoped, 404 for a cross-org or unknown id — mirroring how deleteApiKey hard-deletes a plugin key. The delete…

Verify a webhook endpoint POST

Live, synchronous probe: SSRF-checks the stored URL, then POSTs a signed synthetic test request (Standard Webhooks headers; event type webhook.verification —…