Skip to main content
POST
Rotate webhook secret

Authorizations

Authorization
string
header
required

Keycloak JWT. Roles: admin (platform admin — can register merchants, act on behalf of any merchant), merchant (dashboard user — scoped to their own merchant_id via user attribute mapper), POS terminals use client credentials flow with merchant_id injected via protocol mapper.

Path Parameters

counterID
string<uuid>
required

Counter ID

Response

New webhook secret generated

success
boolean
Example:

true

webhook_secret
string

New HMAC-SHA256 signing secret (64 hex chars). Store securely — shown only once.

Example:

"a3f8c2e1d4b7a9f0e2c5b8d1a4f7c0e3d6b9a2f5c8e1d4b7a0f3c6e9d2b5a8f1"

note
string
Example:

"Update your webhook handler immediately — the old secret is no longer valid."