Rotate a hook's signing secret
Issues a new signing secret for a webhook trigger verified with the `b3os` scheme and returns it once. The previous secret keeps verifying deliveries for `grace_s` seconds (default one day) so senders can switch.
POST
/v1/routines/{routine}/hooks/{hook_id}/rotate
Issues a new signing secret for a webhook trigger verified with the `b3os` scheme and returns it once. The
previous secret keeps verifying deliveries for `grace_s` seconds (default one day) so senders can switch.
Authentication
Bearer Token (b3os_sk_ API key or b3os_pat_ token) API Key (cookie: __Host-b3os_session)
Path Parameters
routine
string
required
path
A routine ID (`rtn_…`) or name. Names are unique per project; `runs`, `hooks`, `validate` and `import` are
reserved and cannot be routine names.
Example:
"nightly-digest"hook_id
string
required
path
The hook ID (`hk_…`).
Example:
"hk_01m5t3r2qwz23751t0x74bhahz"Request Body
application/jsongrace_s
integer
Responses
200
The new secret.
application/jsonobject
string
REQUIRED
Enum:
hook_secrethook_id
string
REQUIRED
secret
string
REQUIRED
previous_valid_until
string (date-time) | null
REQUIRED
400
The request failed validation (`invalid_request`, `invalid_url`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
401
Missing, malformed, expired or revoked credentials (`unauthorized`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
403
Authenticated but not allowed (`forbidden`, `egress_denied`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
404
No such hook (`hook_not_found`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
413
The request body exceeds this operation's limit.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
415
The Content-Type is not accepted by this operation.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
429
A rate, concurrency or quota limit applies (`rate_limited`, `concurrency_limited`, `quota_exceeded`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
500
Something failed inside B3OS (`internal`). Retry with backoff.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
503
The node or the product is not available right now (`node_unavailable`, `product_unavailable`, `capacity_unavailable`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
curl -X POST 'https://beta-api.b3os.org/v1/routines/nightly-digest/hooks/hk_01m5t3r2qwz23751t0x74bhahz/rotate' \ -H 'Authorization: Bearer YOUR_API_TOKEN' \ -H 'Content-Type: application/json' \ -d '{ "grace_s": 3600}'const response = await fetch('https://beta-api.b3os.org/v1/routines/nightly-digest/hooks/hk_01m5t3r2qwz23751t0x74bhahz/rotate', { method: 'POST', headers: { "Authorization": "Bearer YOUR_API_TOKEN", "Content-Type": "application/json" }, body: JSON.stringify({ "grace_s": 3600 })});const data = await response.json();console.log(data);import requestsheaders = { 'Authorization': 'Bearer YOUR_API_TOKEN'}response = requests.post('https://beta-api.b3os.org/v1/routines/nightly-digest/hooks/hk_01m5t3r2qwz23751t0x74bhahz/rotate', headers=headers, json={ "grace_s": 3600})print(response.json())
200
Response
{ "object": "hook_secret", "hook_id": "hk_01m5t3r2qwz23751t0x74bhahz", "secret": "whsec_ex4mple7ex4mple7ex4mple7ex4mple7", "previous_valid_until": "2026-10-25T20:40:00.000Z"}
400
Response
{ "type": "https://docs.beta.b3os.org/errors#invalid_request", "title": "Invalid request", "status": 400, "code": "invalid_request", "detail": "1 field failed validation", "instance": "req_01m5t4yg394wegr3j4y01qb363", "errors": [ { "pointer": "/url", "detail": "must be an absolute http or https URL" } ]}
401
Response
{ "type": "https://docs.beta.b3os.org/errors#unauthorized", "title": "Unauthorized", "status": 401, "code": "unauthorized", "detail": "API key checksum does not match; check that the whole key was copied", "instance": "req_01m5t4yg394wegr3j4y01qb363", "reason": "malformed"}
403
Response
{ "type": "https://docs.beta.b3os.org/errors#forbidden", "title": "Forbidden", "status": 403, "code": "forbidden", "detail": "This key lacks the scope sandboxes:write", "instance": "req_01m5t4yg394wegr3j4y01qb363", "reason": "scope", "required_scope": "sandboxes:write"}
404
Response
{ "type": "https://docs.beta.b3os.org/errors#hook_not_found", "title": "Hook not found", "status": 404, "code": "hook_not_found", "detail": "No hook hk_01m5t3r2qwz23751t0x74bhahz", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
413
Response
{ "type": "https://docs.beta.b3os.org/errors#payload_too_large", "title": "Payload too large", "status": 413, "code": "payload_too_large", "detail": "Request body is 1572864 bytes; this operation accepts at most 1048576", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
415
Response
{ "type": "https://docs.beta.b3os.org/errors#unsupported_media_type", "title": "Unsupported media type", "status": 415, "code": "unsupported_media_type", "detail": "Expected Content-Type application/json", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
429
Response
{ "type": "https://docs.beta.b3os.org/errors#rate_limited", "title": "Rate limited", "status": 429, "code": "rate_limited", "detail": "60 scrapes per minute allowed; retry in 12 seconds", "instance": "req_01m5t4yg394wegr3j4y01qb363", "retry_after_s": 12, "limit": { "id": "vision.scrape.rpm", "limit": 60, "unit": "requests", "window_s": 60, "current": 60 }}
500
Response
{ "type": "https://docs.beta.b3os.org/errors#internal", "title": "Internal error", "status": 500, "code": "internal", "detail": "internal error", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
503
Response
{ "type": "https://docs.beta.b3os.org/errors#node_unavailable", "title": "Node unavailable", "status": 503, "code": "node_unavailable", "detail": "Node n1 is not reachable; retry in 5 seconds", "instance": "req_01m5t4yg394wegr3j4y01qb363", "retry_after_s": 5}API Playground
Try this endpoint
POST
/v1/routines/{routine}/hooks/{hook_id}/rotate
Response
Response Headers
Request History
Was this page helpful?