Rotate the HMAC secret for webhook signing.

Request

Generates a new server-side HMAC secret for the specified project and replaces the existing one. The full secret is returned once in the response body — this is the only time it is visible in plain text. Store it securely immediately after this call.

Use this endpoint when you want Sinch to generate a cryptographically random secret rather than supplying your own.

Security

OAuth2(Required scopes: write)

Path

projectIdstringrequired

Customer's project id

curl -i -X POST \
  'https://compliance.api.sinch.com/v1/projects/{projectId}/callbackConfig/rotate' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

New secret generated. The full secret is returned once — store it securely.

Bodyapplication/json

projectIdstringread-only

Project ID this callback configuration belongs to.

hmacSecretstring, (password)read-only

The full HMAC secret for webhook signature verification. Returned only once — on creation or rotation.

Response

{
  "projectId": "proj-123",
  "hmacSecret": "f9a3dd71-4c2e-4f87-b901-abc123def456"
}

We'd love to hear from you!