Rotate a receiving domain's signing secret
Irreversible, and classified destructive — a test-environment credential is refused.
There is NO grace window, unlike notification webhooks' 24 hours: your intake function reads ONE secret out of the published routing, so every signature computed with the previous secret stops verifying as soon as that routing is republished, which is about a minute. Deploy the new secret to your endpoint first, or accept a window in which real mail is rejected.
The new secret is returned once and cannot be shown again. There is no request body.
422 webhook_not_set when the domain has no webhook to rotate.
Path parameters
domain string required The receiving domain, by NAME (in.acme.com). A UUID is also accepted. Matched case-insensitively, and scoped to the calling org — a domain belonging to another org is a 404, never a 403.
Responses
Errors follow the RFC 7807 problem format — see the error reference.
hmac_secret string required The new signing secret, shown once. There is NO grace window: your intake function reads one secret from the published routing, so the previous secret stops verifying as soon as that routing is republished — about a minute.
code: invalid_scope), or it is bound to the test environment and this operation is irreversible (code: test_environment_forbidden). Branch on code: the first is fixed by granting the scope, the second only by using a live credential. See the "Live and test credentials" section of the API description. application/problem+json validation_failed Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries validation_code,
field, line/column, missing, candidates and next_step, so a
client can correct the call without a second round of guessing. See
ValidationProblem.
application/problem+json code is internal_error. The
request_id field can be quoted to SendOps support to investigate.
application/problem+json