curl -X POST https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret \
-H "Authorization: Bearer gork_live_YOUR_API_KEY"
import { Gork } from "@gork/sdk"
const gork = new Gork({ apiKey: process.env.GORK_API_KEY })
const rotated = await gork.webhooks.rotateSecret("whk_1a2b3c4d5e6f")
// Save rotated.secret somewhere safe — it will never be shown again.
import requests, os
res = requests.post(
"https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret",
headers={"Authorization": f"Bearer {os.getenv('GORK_API_KEY')}"},
)
{
"data": {
"id": "whk_1a2b3c4d5e6f",
"url": "https://agent.acmecorp.com/hooks/gork",
"subscribedEvents": ["email.received", "email.sent"],
"isActive": true,
"secret": "whsec_9f2c4a1e8b7d6f5a3c2e1d0b9a8f7e6d",
"warning": "This webhook secret is displayed once. Update your HMAC signature verifiers immediately."
}
}
Webhooks
Rotate Webhook Secret
Generate a new HMAC signing secret for a webhook endpoint.
POST
/
v1
/
webhooks
/
{id}
/
rotate-secret
curl -X POST https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret \
-H "Authorization: Bearer gork_live_YOUR_API_KEY"
import { Gork } from "@gork/sdk"
const gork = new Gork({ apiKey: process.env.GORK_API_KEY })
const rotated = await gork.webhooks.rotateSecret("whk_1a2b3c4d5e6f")
// Save rotated.secret somewhere safe — it will never be shown again.
import requests, os
res = requests.post(
"https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret",
headers={"Authorization": f"Bearer {os.getenv('GORK_API_KEY')}"},
)
{
"data": {
"id": "whk_1a2b3c4d5e6f",
"url": "https://agent.acmecorp.com/hooks/gork",
"subscribedEvents": ["email.received", "email.sent"],
"isActive": true,
"secret": "whsec_9f2c4a1e8b7d6f5a3c2e1d0b9a8f7e6d",
"warning": "This webhook secret is displayed once. Update your HMAC signature verifiers immediately."
}
}
Replaces the HMAC signing secret (
whsec_...) for one webhook endpoint. The new secret is returned exactly once in the response — it is never exposed by list endpoints, so store it immediately.
Headers
string
required
Bearer token formatted as
Bearer gork_live_.... Requires the webhooks:write scope.Path parameters
string
required
The webhook ID (
whk_...).Rotation takes effect immediately: deliveries signed with the old secret will fail your
X-Gork-Signature verification. Update your verifier before or at the same time as rotating.Response
object
curl -X POST https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret \
-H "Authorization: Bearer gork_live_YOUR_API_KEY"
import { Gork } from "@gork/sdk"
const gork = new Gork({ apiKey: process.env.GORK_API_KEY })
const rotated = await gork.webhooks.rotateSecret("whk_1a2b3c4d5e6f")
// Save rotated.secret somewhere safe — it will never be shown again.
import requests, os
res = requests.post(
"https://api.gork.email/v1/webhooks/whk_1a2b3c4d5e6f/rotate-secret",
headers={"Authorization": f"Bearer {os.getenv('GORK_API_KEY')}"},
)
{
"data": {
"id": "whk_1a2b3c4d5e6f",
"url": "https://agent.acmecorp.com/hooks/gork",
"subscribedEvents": ["email.received", "email.sent"],
"isActive": true,
"secret": "whsec_9f2c4a1e8b7d6f5a3c2e1d0b9a8f7e6d",
"warning": "This webhook secret is displayed once. Update your HMAC signature verifiers immediately."
}
}
| Code | HTTP | Meaning |
|---|---|---|
webhook_not_found | 404 | No webhook with this ID exists in your organization. |