Rotate the signing secret
POST
Returns a new signing_secret, the only time Ricky shows it. Until expire_previous_after_hours passes, every delivery carries two signatures in X-Ricky-Signature, new first, so you can deploy the new secret without missing events. The body is optional.
Scope: webhooks:manage.
bearerAuthheader
AuthorizationBearer <token>An organization API key, rky_live_…, created in Settings → API. Send it only from a server.
webhook_id*stringWebhook ID.
Format
uuidapplication/json- body
expire_previous_after_hours?integerHow long deliveries keep the previous signature too, so you can deploy the new secret first. 0 ends the previous secret now.
Range
0 <= value <= 72Default
24Success.
application/json- response
data*A new webhook subscription with its signing secret.
curl -X POST 'https://getricky.ai/api/v1/webhooks/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate-secret' \ -H 'Content-Type: application/json' \ -d '{ "expire_previous_after_hours": 24}'{ "data": { "id": "e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b", "url": "https://example.com/ricky/webhooks", "event_types": [ "message.received" ], "status": "active", "created_at": "2026-10-14T15:30:00.000Z", "disabled_at": "2026-10-14T15:30:00.000Z", "signing_secret": "whsec_7Yb2kQ9…" }}