From babc77bed4818335bd25c44a56bc248f524b70b1 Mon Sep 17 00:00:00 2001 From: Gabriel Miranda Date: Wed, 9 Sep 2026 16:27:10 -0300 Subject: [PATCH 1/2] feat: add webhook signing secret rotation endpoint Co-Authored-By: Claude Fable 5.1 --- resend.yaml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/resend.yaml b/resend.yaml index efb27a0..3a9f5fb 100644 --- a/resend.yaml +++ b/resend.yaml @@ -1550,6 +1550,31 @@ paths: application/json: schema: $ref: '#/components/schemas/DeleteWebhookResponse' + /webhooks/{webhook_id}/signing-secret/rotate: + post: + operationId: webhooks/rotate-signing-secret + tags: + - Webhooks + summary: Rotate a webhook signing secret + description: >- + Generates a new signing secret for the webhook and returns it. Payloads + delivered after the rotation are signed with the new secret. A webhook that + does not exist or was removed returns a 404 not_found. + parameters: + - name: webhook_id + in: path + required: true + schema: + type: string + format: uuid + description: The Webhook ID. + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/RotateWebhookSigningSecretResponse' /webhooks/{webhook_id}/events: get: operationId: webhooks/list-events @@ -4904,6 +4929,22 @@ components: format: uuid description: The ID of the updated webhook. example: '479e3145-dd38-476b-932c-529ceb705947' + RotateWebhookSigningSecretResponse: + type: object + properties: + object: + type: string + description: The type of object. + example: 'webhook' + id: + type: string + format: uuid + description: The ID of the webhook. + example: '479e3145-dd38-476b-932c-529ceb705947' + signing_secret: + type: string + description: The new secret key used to verify webhook payloads. + example: 'whsec_...' DeleteWebhookResponse: type: object properties: From 19ac61802691599a05b8f6078878977eeec085cd Mon Sep 17 00:00:00 2001 From: Gabriel Miranda Date: Wed, 9 Sep 2026 17:20:50 -0300 Subject: [PATCH 2/2] docs: note the 24 hour grace period after rotating a webhook signing secret Co-Authored-By: Claude Fable 5.1 --- resend.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/resend.yaml b/resend.yaml index 3a9f5fb..5487872 100644 --- a/resend.yaml +++ b/resend.yaml @@ -1558,8 +1558,10 @@ paths: summary: Rotate a webhook signing secret description: >- Generates a new signing secret for the webhook and returns it. Payloads - delivered after the rotation are signed with the new secret. A webhook that - does not exist or was removed returns a 404 not_found. + delivered after the rotation are signed with the new secret. The previous + secret keeps verifying payloads for 24 hours, so both secrets are accepted + during that window. A webhook that does not exist or was removed returns a + 404 not_found. parameters: - name: webhook_id in: path