Roll the secret · Sigil Documentation

There is no overlap period, so update the receiver right away, or have it accept both secrets for a minute while you switch. A delivery in flight at that moment is signed with whichever secret was current when it was attempted; if it fails verification on your side and you answer non-2xx, it is simply retried, signed anew.

Authorization

Authorizationstringheaderrequired

Bearer followed by your API key: Bearer sgk_…. The key also works in an X-Api-Key header. See Authentication.

Path parameters

uidstringpathrequired

The webhook's 8-character id. Not case-sensitive.

Response

200 OKThe webhook, with the new secret.

uidstring

The endpoint's id: 8 letters and digits.

urlstring

Where events are posted: a public HTTPS URL.

descriptionstring | null

Your note on what it is for (100 characters at most).

eventsarray of strings | null

The event types it receives, or null for every pact event. A ping is delivered whatever this says.

activeboolean

Whether events are delivered to it. Switched off by you, by a 410 Gone answer, or after 10 failed deliveries in a row; switch it on again with Update a webhook.

consecutive_failuresinteger

Deliveries given up on since the last success. Resets to 0 on the next success.

last_statusinteger | null

The HTTP status of the last attempt. null before the first attempt, and when the last attempt got no response.

date_last_successstring (date-time) | null

When a delivery last got a 2xx.

date_disabledstring (date-time) | null

When it was switched off, while it is.

date_createdstring (date-time)

When it was added.

date_updatedstring (date-time)

When its settings or secret last changed.

secretstring

The signing secret, sgw_ and 40 letters and digits. Keep it where your receiver can read it.

Only in the response to Create a webhook and Roll the secret. It cannot be read back later.

Errors

Status	When
401 Unauthorized	The API key is missing, wrong or revoked.
403 Forbidden	The account's plan does not include API access (Pro and Business do).
404 Not Found	No webhook with that id belongs to your account.

Every error body is { "error": "message" }. See Errors.