Ricky logorickyDocs

Rotate the signing secret

POST
/webhooks/{webhook_id}/rotate-secret

Returns a new signing_secret, the only time Ricky shows it. Until expire_previous_after_hours passes, every delivery carries two signatures in X-Ricky-Signature, new first, so you can deploy the new secret without missing events. The body is optional.

Scope: webhooks:manage.

Authorization

bearerAuth
headerAuthorizationBearer <token>

An organization API key, rky_live_…, created in Settings → API. Send it only from a server.

Path Parameters

webhook_id*string

Webhook ID.

Formatuuid

Request Body

application/json
  1. body
expire_previous_after_hours?integer

How long deliveries keep the previous signature too, so you can deploy the new secret first. 0 ends the previous secret now.

Range0 <= value <= 72
Default24

Response Body

Success.

application/json
  1. response
data*

A new webhook subscription with its signing secret.

curl -X POST 'https://getricky.ai/api/v1/webhooks/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate-secret' \  -H 'Content-Type: application/json' \  -d '{  "expire_previous_after_hours": 24}'
{  "data": {    "id": "e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b",    "url": "https://example.com/ricky/webhooks",    "event_types": [      "message.received"    ],    "status": "active",    "created_at": "2026-10-14T15:30:00.000Z",    "disabled_at": "2026-10-14T15:30:00.000Z",    "signing_secret": "whsec_7Yb2kQ9…"  }}