Endpoint

Roll the signing secret

POST/v1/webhook_endpoints/{id}/roll_secret

Returns a new secret. The old one keeps signing as well for expires_in seconds, so every delivery in that window carries two v1 signatures. In live mode a key cannot roll it: it answers passkey_approval_required with reason webhook_dashboard_only; the dashboard rolls it with a passkey. A replay of the same request answers without secret.

Scope a restricted key needs: webhooks:write
Publishable key: Not allowed: secret or restricted key only
Idempotency-Key: Recommended. It makes a retry safe.

Parameters

Parameters of Roll the signing secret
Parameter	Type and place	Meaning
`id`required	stringpath	The id of the endpoint.
`Orrerie-Version`	stringheader	API version date. Default: the version the key was created with. Example `2026-10-11`.
`Idempotency-Key`	stringheader	Makes a retry safe. Kept 24 hours. 1 to 255 characters.

Request body

A JSON object. The body may be left out. A field the call does not list is refused with parameter_unknown.

Request body of Roll the signing secret
Field	Type	Meaning
`expires_in`	integer	Seconds the old secret stays valid: 0 to 86,400. Default 86,400.

Example request

curl

curl https://api.orrerie.com/v1/webhook_endpoints/we_tx7j2vmn3r2px2vpwbtz5h7b/roll_secret \
  -H "Authorization: Bearer $ORRERIE_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "expires_in": 3600
}'

JavaScript

const response = await fetch("https://api.orrerie.com/v1/webhook_endpoints/we_tx7j2vmn3r2px2vpwbtz5h7b/roll_secret", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORRERIE_SECRET_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "expires_in": 3600
  }),
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result);

Python

import os
import requests

response = requests.post(
    "https://api.orrerie.com/v1/webhook_endpoints/we_tx7j2vmn3r2px2vpwbtz5h7b/roll_secret",
    headers={"Authorization": f"Bearer {os.environ['ORRERIE_SECRET_KEY']}"},
    json={
        "expires_in": 3600,
    },
    timeout=30,
)
result = response.json()
if not response.ok:
    raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result)

PHP

<?php
$request = curl_init('https://api.orrerie.com/v1/webhook_endpoints/we_tx7j2vmn3r2px2vpwbtz5h7b/roll_secret');
curl_setopt_array($request, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ORRERIE_SECRET_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'expires_in' => 3600,
    ]),
]);
$body = curl_exec($request);
if ($body === false) {
    throw new RuntimeException(curl_error($request));
}
$result = json_decode($body, true);
if (curl_getinfo($request, CURLINFO_HTTP_CODE) >= 400) {
    throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result);

Responses

`200` OK

The answer is the webhook_endpoint object. Headers: Orrerie-Request-Id.

Example response, 200

{
  "id": "we_tx7j2vmn3r2px2vpwbtz5h7b",
  "object": "webhook_endpoint",
  "livemode": true,
  "created": "2026-09-03T10:00:00.000Z",
  "url": "https://acme.example/webhooks/orrerie",
  "description": "Shop backend",
  "enabled_events": [
    "order.paid",
    "order.underpaid",
    "order.overpaid",
    "order.expired",
    "refund.confirmed"
  ],
  "status": "enabled",
  "disabled_reason": null,
  "api_version": "2026-10-11",
  "secret_last4": "p7Lm",
  "previous_secret_expires_at": "2026-10-12T13:00:00.000Z",
  "last_success_at": "2026-10-11T14:09:56.020Z",
  "last_failure_at": null,
  "metadata": {},
  "secret": "whsec_EXAMPLE2EXAMPLE2EXAMPLE2EXAMPLE2EXAMPLE2p7Lm"
}

Any other status: an error

A status of 400 or above answers with the error object. Branch on its code, never on its message.

Errors

Beside the errors every call can answer with (a bad key, a missing scope, the rate limit), this call answers with:

Errors of Roll the signing secret
Code	HTTP	Meaning
`passkey_approval_required`	403	The action can only be done by a signed-in member in the dashboard (settlement asset, key-holding roles, approvals). No API key can do it.