curl --request POST \
--url https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret \
--header 'x-api-key: <api-key>'import requests
url = "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"id": "8b95a9e0-4af3-4c6d-92df-84b64256d27f",
"name": "Production booking events",
"url": "https://example.com/webhooks/unifystays",
"status": "ACTIVE",
"event_types": [
"booking.confirmed",
"booking.cancelled"
],
"consecutive_failures": 0,
"last_success_at": "2026-08-08T08:30:00.000Z",
"last_failure_at": null,
"disabled_at": null,
"disabled_reason": null,
"created_at": "2026-08-08T08:00:00.000Z",
"updated_at": "2026-08-08T08:30:00.000Z",
"signing_secret": "whsec_************************",
"previous_secret_valid_until": "2026-08-09T08:30:00.000Z"
}Rotate Webhook Secret
Issue a new signing secret with a 24-hour verification overlap.
curl --request POST \
--url https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret \
--header 'x-api-key: <api-key>'import requests
url = "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.unifystays.com/webhooks/endpoints/{endpoint_id}/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"id": "8b95a9e0-4af3-4c6d-92df-84b64256d27f",
"name": "Production booking events",
"url": "https://example.com/webhooks/unifystays",
"status": "ACTIVE",
"event_types": [
"booking.confirmed",
"booking.cancelled"
],
"consecutive_failures": 0,
"last_success_at": "2026-08-08T08:30:00.000Z",
"last_failure_at": null,
"disabled_at": null,
"disabled_reason": null,
"created_at": "2026-08-08T08:00:00.000Z",
"updated_at": "2026-08-08T08:30:00.000Z",
"signing_secret": "whsec_************************",
"previous_secret_valid_until": "2026-08-09T08:30:00.000Z"
}signing_secret becomes active immediately and is returned only in this
response. The previous secret remains valid until
previous_secret_valid_until.
During the 24-hour overlap, webhook requests include both v1 and v0
signatures. Update your receiver to accept the new secret before removing the
old one.
Read the signature verification guideAuthorizations
Environment-specific API key created in the Unifystays portal
Headers
Path Parameters
Webhook endpoint UUID.
"8b95a9e0-4af3-4c6d-92df-84b64256d27f"
Response
Signing secret rotated successfully.
Unique webhook endpoint identifier.
"8b95a9e0-4af3-4c6d-92df-84b64256d27f"
Human-readable endpoint name.
"Production booking events"
URL that receives signed webhook POST requests.
"https://example.com/webhooks/unifystays"
Current endpoint state. Paused and disabled endpoints do not receive new deliveries.
ACTIVE, PAUSED, DISABLED "ACTIVE"
Normalized event subscriptions for this endpoint.
booking.created, booking.confirmed, booking.failed, booking.cancellation_requested, booking.cancelled, booking.cancellation_failed, booking.* ["booking.confirmed", "booking.cancelled"]
Consecutive delivery failures since the last success or reactivation.
0
Time of the most recent successful delivery, if any.
"2026-08-08T08:30:00.000Z"
Time of the most recent failed delivery, if any.
null
Time the endpoint was disabled, if applicable.
null
Reason the endpoint was disabled, if applicable.
null
Endpoint creation time.
"2026-08-08T08:00:00.000Z"
Time the endpoint was last updated.
"2026-08-08T08:30:00.000Z"
HMAC signing secret. Returned only once; store it securely before discarding the response.
"whsec_************************"
Time until which signatures made with the previous secret remain valid.
"2026-08-09T08:30:00.000Z"