Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.

Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.

Path Parameters

endpoint_id
string
required

The endpoint's whe_ id. An id that is unknown, malformed or another workspace's answers 404. Opaque id of the endpoint registration.

Pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$

Body

application/json

POST /v1/webhooks/{endpoint_id}/rotate body: an empty object. The old key keeps verifying for 7 days.

Response

The new signing secret, shown once. Both keys verify until previous_key_expires_at; deliveries are signed with the new one from now on.

The 201 answer of POST /v1/webhooks/{endpoint_id}/rotate: the new signing secret, shown once, which signs every delivery from now on, and when the key it replaced stops verifying. Until then a receiver accepts both.

endpoint_id
string
required

Opaque id of the endpoint registration.

Pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$
signing_secret
object
required

A newly issued signing key with its secret, shown only in this answer. A receiver verifies NR-Webhook-Signature with the secret's UTF-8 bytes as the HMAC-SHA256 key.

previous_key_id
string
required

The key that signed until this rotation.

Pattern: ^whk_[A-Za-z0-9]{8,64}$
previous_key_expires_at
string<date-time>
required

When the previous key stops verifying: 7 days after the rotation.