When it fires
After RotateWebhookSecretService succeeds. The new secret is not in the payload, only secretLastFour for identification.
The endpoint that was rotated will receive this event signed with its new secret. Make sure your receiver has the new secret before triggering rotation, or use a separate audit endpoint.
Payload
ts
{
type: 'webhook.secret_rotated',
data: {
webhook: {
id: string
name: string
secretLastFour: string
secretRolledAt: string | null
}
}
}Example
json
{
"type": "webhook.secret_rotated",
"data": {
"webhook": {
"id": "0192a1b2-c3d4-7000-8000-0000000000d0",
"name": "PagerDuty bridge",
"secretLastFour": "p7r4",
"secretRolledAt": "2026-05-31T13:30:00.000Z"
}
}
}