Rotate the signing secret (dual-secret overlap)
Mints a new signing secret and returns it IN FULL, exactly once. Until previousSecretExpiresAt, deliveries are signed with BOTH the new and the old secret (two v1= entries in the signature header), so either verifies while you cut over. Rotating again inside the window replaces the old secret immediately.
Mints a new signing secret and returns it IN FULL, exactly once. Until previousSecretExpiresAt, deliveries are signed with BOTH the new and the old secret (two v1= entries in the signature header), so either verifies while you cut over. Rotating again inside the window replaces the old secret immediately.
Authorization
bearer In: header
Path Parameters
The webhookId returned when the endpoint was registered.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/partner/v1/webhooks/4e8b1d70-a35c-4692-b0f1-9d2c6a4e73b8/rotate-secret"{ "data": { "createdAt": "2026-08-14T08:42:11.000Z", "disclosure": { "items": [ "ENVIRONMENT_IS_TESTNET: The environment is a testnet (Arbitrum Sepolia). No mainnet deployment exists.", "YIELD_IS_SIMULATED: The vault rate is set administratively and the interest it produces is minted as fresh underlying, not earned. It does not represent a return generated by deployed capital.", "FIAT_RAILS_ARE_MOCKED: No real fiat movement occurs. Balances are ledger entries against a sandbox provider.", "CONVERSION_RATES_ARE_MARKET_QUOTED_OR_REFUSED: A conversion is priced only by an external venue that quotes independently of TCB. When no such venue can price the pair, the conversion is refused rather than priced from an internal table. Read rate.pricingModel on every conversion: MARKET is a venue quote; any other value is not a market rate and must not be presented as one.", "CONTRACTS_ARE_UNAUDITED: No audit has been performed. Mainnet is gated on a two-firm audit that has not been commissioned.", "CUSTODY_IS_TCB_SUBACCOUNT: Everything held for the client — its vault shares, and the tcbUSD it holds between the steps of the tokenised deposit chain — is held in TCB custody, in the one TCB wallet assigned to the client. The client holds no keys and moves those tokens only through this API; each sub-account's shares and tcbUSD are book entries against what that wallet holds.", "INTEGRATION_AGREEMENT_ONLY: Fees as published on the rate card; no yield share, no return commitment." ], "summary": "This is a pilot integration on a testnet. Nothing in this system earns anything: the yield is simulated and the fiat rails are mocked.", "version": "2026-10-27" }, "events": [ "deposit.settled", "withdrawal.settled" ], "previousSecretExpiresAt": "2026-09-03T10:15:30.000Z", "secret": "whsec_k3vJ9aQ2mR7xL0pT4wZ8nB1yC6dF5gH2jK9sV3eA7u", "secretPreview": "whsec_k3vJ9aQ2…", "status": "ACTIVE", "url": "https://partner.example.com/tcb/webhooks", "webhookId": "4e8b1d70-a35c-4692-b0f1-9d2c6a4e73b8" }, "success": true, "timestamp": "2026-09-02T10:15:30.000Z"}Disable a webhook endpoint DELETE
Disables delivery. The subscription row and its delivery history are retained — they are the record of what was sent where — and undelivered events stop being attempted while the endpoint is disabled.
Identify the authenticated client principal GET
Identifies the authenticated principal — the integration smoke test. Your API key is the only credential: no browser session and no other headers are involved. Called with x-on-behalf-of it answers principalType SUB_CLIENT with that sub-client id, alongside your unchanged root clientAccountId. subtreeRestricted reports whether the key may act for every one of your sub-clients or only a subset.