Rotate Webhook Secret

Rotate an endpoint signing secret

curl --request POST \
  --url https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret \
  --header 'x-api-key: <api-key>'

import requests

url = "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"

headers = {"x-api-key": "<api-key>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

fetch('https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "id": "8b95a9e0-4af3-4c6d-92df-84b64256d27f",
  "name": "Production booking events",
  "url": "https://example.com/webhooks/unifystays",
  "status": "ACTIVE",
  "event_types": [
    "booking.confirmed",
    "booking.cancelled"
  ],
  "consecutive_failures": 0,
  "last_success_at": "2026-08-08T08:30:00.000Z",
  "last_failure_at": null,
  "disabled_at": null,
  "disabled_reason": null,
  "created_at": "2026-08-08T08:00:00.000Z",
  "updated_at": "2026-08-08T08:30:00.000Z",
  "signing_secret": "whsec_************************",
  "previous_secret_valid_until": "2026-08-09T08:30:00.000Z"
}

POST

webhooks

endpoints

{endpoint_id}

rotate-secret

Rotate an endpoint signing secret

curl --request POST \
  --url https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret \
  --header 'x-api-key: <api-key>'

import requests

url = "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"

headers = {"x-api-key": "<api-key>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

fetch('https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "id": "8b95a9e0-4af3-4c6d-92df-84b64256d27f",
  "name": "Production booking events",
  "url": "https://example.com/webhooks/unifystays",
  "status": "ACTIVE",
  "event_types": [
    "booking.confirmed",
    "booking.cancelled"
  ],
  "consecutive_failures": 0,
  "last_success_at": "2026-08-08T08:30:00.000Z",
  "last_failure_at": null,
  "disabled_at": null,
  "disabled_reason": null,
  "created_at": "2026-08-08T08:00:00.000Z",
  "updated_at": "2026-08-08T08:30:00.000Z",
  "signing_secret": "whsec_************************",
  "previous_secret_valid_until": "2026-08-09T08:30:00.000Z"
}

The new signing_secret becomes active immediately and is returned only in this response. The previous secret remains valid until previous_secret_valid_until. During the 24-hour overlap, webhook requests include both v1 and v0 signatures. Update your receiver to accept the new secret before removing the old one. Read the signature verification guide

Authorizations

x-api-key

string

header

required

Environment-specific API key created in the Unifystays portal

Headers

Path Parameters

endpoint_id

string

required

Webhook endpoint UUID.

Example:

"8b95a9e0-4af3-4c6d-92df-84b64256d27f"

Response

200 - application/json

Signing secret rotated successfully.

string<uuid>

required

Unique webhook endpoint identifier.

Example:

"8b95a9e0-4af3-4c6d-92df-84b64256d27f"

name

string

required

Human-readable endpoint name.

Example:

"Production booking events"

url

string<uri>

required

URL that receives signed webhook POST requests.

Example:

"https://example.com/webhooks/unifystays"

status

enum<string>

required

Current endpoint state. Paused and disabled endpoints do not receive new deliveries.

Available options:

ACTIVE,

PAUSED,

DISABLED

Example:

"ACTIVE"

event_types

enum<string>[]

required

Normalized event subscriptions for this endpoint.

Available options:

booking.created,

booking.confirmed,

booking.failed,

booking.cancellation_requested,

booking.cancelled,

booking.cancellation_failed,

booking.*

Example:

["booking.confirmed", "booking.cancelled"]

consecutive_failures

number

required

Consecutive delivery failures since the last success or reactivation.

Example:

0

last_success_at

string<date-time> | null

required

Time of the most recent successful delivery, if any.

Example:

"2026-08-08T08:30:00.000Z"

last_failure_at

string<date-time> | null

required

Time of the most recent failed delivery, if any.

Example:

null

disabled_at

string<date-time> | null

required

Time the endpoint was disabled, if applicable.

Example:

null

disabled_reason

string | null

required

Reason the endpoint was disabled, if applicable.

Example:

null

created_at

string<date-time>

required

Endpoint creation time.

Example:

"2026-08-08T08:00:00.000Z"

updated_at

string<date-time>

required

Time the endpoint was last updated.

Example:

"2026-08-08T08:30:00.000Z"

signing_secret

string

required

HMAC signing secret. Returned only once; store it securely before discarding the response.

Example:

"whsec_************************"

previous_secret_valid_until

string<date-time> | null

required

Time until which signatures made with the previous secret remain valid.

Example:

"2026-08-09T08:30:00.000Z"

⌘I

Overview

Destination & master data

Search & hotels

Bookings

Webhook endpoints

Webhook logs

Authorizations

Headers

Path Parameters

Response