curl --request POST \
--url 'https://api.noresponse.org/v1/webhooks/whe_01JA2ZD0E1F2G3H4J5K6M7N8P9/rotate' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.webhookEndpoints.rotateSigningKey({
endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
body: {},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.webhook_endpoints.rotate_signing_key(endpoint_id="whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", body={})
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.WebhookEndpoints.RotateSigningKey(ctx, "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", components.WebhookKeyRotationRequest{})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.RotateWebhookSigningKeyResponse;
import org.noresponse.models.shared.WebhookKeyRotationRequest;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
RotateWebhookSigningKeyResponse res = sdk.webhookEndpoints().rotateSigningKey()
.endpointId("whe_01JA2ZD0E1F2G3H4J5K6M7N8P9")
.body(WebhookKeyRotationRequest.builder()
.build())
.call();
if (res.webhookKeyRotation().isPresent()) {
System.out.println(res.webhookKeyRotation().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.WebhookEndpoints.RotateSigningKeyAsync(
endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
body: new WebhookKeyRotationRequest() {}
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\WebhookKeyRotationRequest();
$response = $sdk->webhookEndpoints->rotateSigningKey(
endpointId: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9',
body: $body
);
if ($response->webhookKeyRotation !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.webhook_endpoints.rotate_signing_key(endpoint_id: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9', body: Models::Shared::WebhookKeyRotationRequest.new)
unless res.nil?
# handle response
end
{
"endpoint_id": "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
"signing_secret": {
"key_id": "whk_01JA2ZD1M2N3P4Q5R6S7T8V9W0",
"secret": "cm90YXRlZC1mb3ItZG9jcy1vbmx5LW5vdC1yZWFsLTE",
"created_at": "2026-10-22T10:00:00.000Z"
},
"previous_key_id": "whk_01JA2Z9A1B2C3D4E5F6G7H8J9K",
"previous_key_expires_at": "2026-10-29T10:00:00.000Z"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/workspace-forbidden",
"title": "Forbidden",
"status": 403,
"detail": "The API key does not carry a scope this operation accepts.",
"code": "workspace_forbidden",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/rate-limited",
"title": "Rate limited",
"status": 429,
"detail": "The tenant's assessment rate is exhausted; retry after the Retry-After interval.",
"code": "rate_limited",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Rotate a webhook signing key
Issues a new signing key for the endpoint and returns its secret once. Every delivery from now on is signed with it.
The key it replaces keeps verifying for 7 days, so your receiver can hold both secrets while you roll the new one out. Rotation is not idempotent: a retry after a lost answer issues another key. Requires the webhooks scope.
curl --request POST \
--url 'https://api.noresponse.org/v1/webhooks/whe_01JA2ZD0E1F2G3H4J5K6M7N8P9/rotate' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.webhookEndpoints.rotateSigningKey({
endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
body: {},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.webhook_endpoints.rotate_signing_key(endpoint_id="whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", body={})
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.WebhookEndpoints.RotateSigningKey(ctx, "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", components.WebhookKeyRotationRequest{})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.RotateWebhookSigningKeyResponse;
import org.noresponse.models.shared.WebhookKeyRotationRequest;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
RotateWebhookSigningKeyResponse res = sdk.webhookEndpoints().rotateSigningKey()
.endpointId("whe_01JA2ZD0E1F2G3H4J5K6M7N8P9")
.body(WebhookKeyRotationRequest.builder()
.build())
.call();
if (res.webhookKeyRotation().isPresent()) {
System.out.println(res.webhookKeyRotation().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.WebhookEndpoints.RotateSigningKeyAsync(
endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
body: new WebhookKeyRotationRequest() {}
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\WebhookKeyRotationRequest();
$response = $sdk->webhookEndpoints->rotateSigningKey(
endpointId: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9',
body: $body
);
if ($response->webhookKeyRotation !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.webhook_endpoints.rotate_signing_key(endpoint_id: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9', body: Models::Shared::WebhookKeyRotationRequest.new)
unless res.nil?
# handle response
end
{
"endpoint_id": "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9",
"signing_secret": {
"key_id": "whk_01JA2ZD1M2N3P4Q5R6S7T8V9W0",
"secret": "cm90YXRlZC1mb3ItZG9jcy1vbmx5LW5vdC1yZWFsLTE",
"created_at": "2026-10-22T10:00:00.000Z"
},
"previous_key_id": "whk_01JA2Z9A1B2C3D4E5F6G7H8J9K",
"previous_key_expires_at": "2026-10-29T10:00:00.000Z"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/workspace-forbidden",
"title": "Forbidden",
"status": 403,
"detail": "The API key does not carry a scope this operation accepts.",
"code": "workspace_forbidden",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/rate-limited",
"title": "Rate limited",
"status": 429,
"detail": "The tenant's assessment rate is exhausted; retry after the Retry-After interval.",
"code": "rate_limited",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Path Parameters
The endpoint's whe_ id. An id that is unknown, malformed or another workspace's answers 404. Opaque id of the endpoint registration.
^whe_[0-9A-HJKMNP-TV-Z]{26}$Body
POST /v1/webhooks/{endpoint_id}/rotate body: an empty object. The old key keeps verifying for 7 days.
Response
The new signing secret, shown once. Both keys verify until previous_key_expires_at; deliveries are signed with the new one from now on.
The 201 answer of POST /v1/webhooks/{endpoint_id}/rotate: the new signing secret, shown once, which signs every delivery from now on, and when the key it replaced stops verifying. Until then a receiver accepts both.
Opaque id of the endpoint registration.
^whe_[0-9A-HJKMNP-TV-Z]{26}$A newly issued signing key with its secret, shown only in this answer. A receiver verifies NR-Webhook-Signature with the secret's UTF-8 bytes as the HMAC-SHA256 key.
Show child attributes
Show child attributes
The key that signed until this rotation.
^whk_[A-Za-z0-9]{8,64}$When the previous key stops verifying: 7 days after the rotation.