coss.comdocs

Roll an endpoint's secret

POST
/v1/hooks/applications/{application}/endpoints/{endpoint_id}/roll_secret

Replaces the signing secret, returned here. Until previous_secret_expires_at, requests carry a signature with each secret, so the receiver can switch without rejecting any. Not idempotent.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Path Parameters

application*string

The application's id (happ_…) or your uid for it.

endpoint_id*string

The endpoint's id.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
previous_secret_expires_in?integer

Seconds the current secret keeps signing next to the new one. Default 86400 (a day), at most 604800 (a week); 0 stops it immediately.

Range0 <= value <= 604800

Response Body

The endpoint and its new secret.

application/json
  1. response
object*"hook_endpoint"
Value in"hook_endpoint"
id*string
application_id*string
url*string
description*string|null
filter_types*array<string>
rate_limit_per_second*integer|null
enabled*boolean
disabled_reason*|

manual: disabled by you or its user. failing: its deliveries failed every attempt for five days, so COSS disabled it. null while enabled.

Value in"manual""failing"null
disabled_at*|
Formatdate-time
failing_since*|

When its current run of failed deliveries began; cleared by the next success. null while healthy.

Formatdate-time
previous_secret_expires_at*|

After a secret roll, requests are also signed with the previous secret until then.

Formatdate-time
metadata*
created_at*string
Formatdate-time
updated_at*string
Formatdate-time
secret*string

The endpoint's whsec_… signing secret (Standard Webhooks).

import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.hooks.endpoints.rollSecret("customer_8812", "hep_01k7c8m4q2f3e9v6t5r1n0p8yz", {  previous_secret_expires_in: 3600,});
{  "object": "hook_endpoint",  "id": "hep_01k7c8m4q2f3e9v6t5r1n0p8yz",  "application_id": "happ_01k7c8m4q2f3e9v6t5r1n0p8yz",  "url": "https://example.com/webhooks",  "description": "Production",  "filter_types": [    "invoice.paid"  ],  "rate_limit_per_second": null,  "enabled": true,  "disabled_reason": null,  "disabled_at": null,  "failing_since": null,  "previous_secret_expires_at": null,  "metadata": {},  "created_at": "2026-01-15T09:30:00.000Z",  "updated_at": "2026-01-15T09:30:00.000Z",  "secret": "whsec_6Jk…"}