Webhooks
Rotate Secret
Replace the signing secret of a webhook
POST
/
api
/
v1
/
webhooks
/
{id}
/
rotate-secret
curl --request POST \
--url https://anivahealth.com/api/v1/webhooks/4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d/rotate-secret \
--header 'x-api-key: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{
"revoke_current_secret_now": false
}'
{
"id": "4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d",
"url": "https://partner.example.com/webhooks/aniva",
"description": "Production",
"enabled_events": [
"appointment.confirmed",
"appointment.results.completed",
"home_kit_order.results.completed"
],
"alert_emails": ["ops@partner.example.com"],
"status": "enabled",
"disabled_at": null,
"disabled_reason": null,
"failing_since": null,
"previous_secret_expires_at": "2026-10-17T10:00:00.000Z",
"created_at": "2026-10-15T08:00:00.000Z",
"updated_at": "2026-10-16T10:00:00.000Z",
"secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw8L0qsE2bkS4="
}
{
"error": "Webhook not found"
}
Create a new signing secret for a webhook. The old secret keeps signing for 24 hours, until
previous_secret_expires_at. A second rotation within that time stops the oldest secret at once.
Requires the
webhooks_manage scope.Request
Path parameters
string
required
Webhook identifier (UUID).
Body parameters
The body is optional.boolean
default:"false"
true stops the current secret at once, for example after a leak.Response
On success, the API returns200 OK with the webhook and its new secret.
string
required
The signing secret,
whsec_ plus base64. Aniva shows it only in this response. See Verify the
signature.string
required
Webhook identifier (UUID).
string
required
The HTTPS URL Aniva posts events to.
string
Free text for your own reference. May be
null.string[]
required
Event types this webhook receives.
* means every type.string[]
required
Addresses Aniva emails when deliveries keep failing.
string
required
enabled or disabled.string
ISO 8601 UTC instant the webhook was disabled.
null while enabled.string
Why the webhook was disabled. See Failure notices.
null
while enabled.string
ISO 8601 UTC instant the current failure streak started.
null when the last delivery succeeded.string
ISO 8601 UTC instant the previous secret stops signing.
null when no rotation is in progress.string
required
ISO 8601 UTC instant the webhook was created.
string
required
ISO 8601 UTC instant of the last change.
Error responses
| Status | Description |
|---|---|
400 | Invalid request. See the error message. |
401 | Invalid API key. |
403 | No API key, or an API key without the webhooks_manage scope. |
404 | Webhook not found, or it belongs to another API key. |
500 | Internal server error. |
curl --request POST \
--url https://anivahealth.com/api/v1/webhooks/4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d/rotate-secret \
--header 'x-api-key: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{
"revoke_current_secret_now": false
}'
{
"id": "4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d",
"url": "https://partner.example.com/webhooks/aniva",
"description": "Production",
"enabled_events": [
"appointment.confirmed",
"appointment.results.completed",
"home_kit_order.results.completed"
],
"alert_emails": ["ops@partner.example.com"],
"status": "enabled",
"disabled_at": null,
"disabled_reason": null,
"failing_since": null,
"previous_secret_expires_at": "2026-10-17T10:00:00.000Z",
"created_at": "2026-10-15T08:00:00.000Z",
"updated_at": "2026-10-16T10:00:00.000Z",
"secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw8L0qsE2bkS4="
}
{
"error": "Webhook not found"
}
⌘I
curl --request POST \
--url https://anivahealth.com/api/v1/webhooks/4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d/rotate-secret \
--header 'x-api-key: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{
"revoke_current_secret_now": false
}'
{
"id": "4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d",
"url": "https://partner.example.com/webhooks/aniva",
"description": "Production",
"enabled_events": [
"appointment.confirmed",
"appointment.results.completed",
"home_kit_order.results.completed"
],
"alert_emails": ["ops@partner.example.com"],
"status": "enabled",
"disabled_at": null,
"disabled_reason": null,
"failing_since": null,
"previous_secret_expires_at": "2026-10-17T10:00:00.000Z",
"created_at": "2026-10-15T08:00:00.000Z",
"updated_at": "2026-10-16T10:00:00.000Z",
"secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw8L0qsE2bkS4="
}
{
"error": "Webhook not found"
}