Generate new secret for partner's webhook

Generate New Secret for Partner's Webhook

This endpoint generates a new secret key for a specified partner webhook. The new secret replaces the existing one immediately, invalidating the old secret. Webhook secrets are used to cryptographically sign webhook payloads so partners can verify that requests originated from the Netevia banking service.

Endpoint

POST /api/Partners/webhooks/{id}

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint to rotate the webhook secret as part of regular security hygiene or immediately after a suspected compromise of the current secret. Once a new secret is generated, the partner must update their signature verification logic to use it, as the previous secret becomes invalid. Periodic secret rotation is a best practice for maintaining the integrity of webhook delivery.

Path Parameters

Response

200 OK

A successful response indicates the new secret has been generated. Partners should retrieve and store the new secret immediately and update their webhook signature verification logic.

{}

Note: Once the new secret is generated, the previous secret is immediately invalidated. Update your signature verification logic before making this call if uninterrupted webhook processing is required.

Error Codes

Common Mistakes

• Failing to update the partner-side signature verification logic immediately after rotating the secret, causing webhook payload validation to fail.
• Using a stale or expired Bearer token — obtain a fresh token before calling this endpoint.
• Providing a non-integer or invalid value for the id path parameter, resulting in a 400 error.

Related Endpoints

• GET /api/Partners/webhooks — List all webhooks registered for the partner
• POST /api/Partners/webhooks — Register a new webhook for the partner
• DELETE /api/Partners/webhooks/{id} — Remove a webhook registration

Example

curl -X POST https://api.banking.netevia.dev/api/Partners/webhooks/123 \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"