Webhook management

Rotate the signing secret

Replace the endpoint's signing secret. The new secret is returned once and signs every delivery from now on, retries included: deploy it to your receiver right away.

POST https://el-b.com/api/v1/webhooks/{id}/rotate-secret

Authorization

Authorizationheaderrequired

Bearer elb_sk_…: your API key, from API in your El-B account.

Path parameters

id string required

The endpoint's id.

Responses

Status	Meaning
`200`	Success. The body is shown alongside.
`404`	No endpoint with this id in your account.
`401`	Missing, unknown or paused API key.
`403`	The account is suspended, or no longer verified by an official document.
`429`	More than 60 requests in a minute. See Rate limits.

use Illuminate\Support\Facades\Http; $response = Http::withToken(env('ELB_API_KEY')) ->acceptJson() ->post('https://el-b.com/api/v1/webhooks/0199c1e4-7a2b-7d31-9e0f-4b6c8d2a1f57/rotate-secret'); $payment = $response->json('data');

const response = await fetch('https://el-b.com/api/v1/webhooks/0199c1e4-7a2b-7d31-9e0f-4b6c8d2a1f57/rotate-secret', { method: 'POST', headers: { Authorization: `Bearer ${process.env.ELB_API_KEY}`, Accept: 'application/json', }, }); const { data } = await response.json();

import os import requests response = requests.request( "POST", "https://el-b.com/api/v1/webhooks/0199c1e4-7a2b-7d31-9e0f-4b6c8d2a1f57/rotate-secret", headers={"Authorization": f"Bearer {os.environ['ELB_API_KEY']}"}, ) data = response.json()

{ "data": { "id": "0199c1e4-7a2b-7d31-9e0f-4b6c8d2a1f57", "url": "https://shop.example.com/elb/webhooks", "events": [ "payment.reference_submitted", "payment.finalized" ], "is_active": true, "signing_secret_hint": "whsec_7Kq…", "last_triggered_at": "2026-11-02T10:24:39+01:00", "created_at": "2026-11-01T09:00:00+01:00" }, "signing_secret": "whsec_Zx81Lm0Qp4Rt7Yv2Wn6Bc9Hd3Kf5Js1AeG4uI8" }