# Set a customer-provided HMAC secret for webhook signing.

Sets a customer-provided HMAC secret for the specified project. The full secret is returned
once in the response body — this is the only time it is visible in plain text. Store it
securely immediately after this call.

Endpoint: PATCH /v1/projects/{projectId}/callbackConfig
Version: 1.0.0
Security: OAuth2

## Path parameters:

  - `projectId` (string, required)
    Customer's project id

## Request fields (application/json):

  - `hmacSecret` (string)
    The HMAC secret to be updated for the specified project

## Response 200 fields (application/json):

  - `projectId` (string)
    Project ID this callback configuration belongs to.

  - `hmacSecret` (string)
    The full HMAC secret for webhook signature verification. Returned only once — on creation or rotation.

## Response 400 fields (application/problem+json):

  - `type` (string, required)
    A URI reference that identifies the problem type. This URI reference should provide a human-readable explanation of the problem type when dereferenced.

  - `title` (string, required)
    A short, human-readable summary of the problem type. It should not change from occurrence to occurrence of the problem, except for localization purposes.

  - `body` (object) — one of:
    - variant 1:
      - `errors` (array)
        Detailed information about the error. This field can contain multiple error details to provide more context about the error that occurred.
      - `errors.pointer` (string)
        JSON pointer to the field that caused the error, following RFC 6901.
      - `errors.detail` (string)
        A human-readable explanation specific to this occurrence of the problem. Like title, this field is not intended for end users, but rather for developers to understand the details of the error that occurred.
    - variant 2:
      - `detail` (string)
        A human-readable explanation of the error that occurred.