Rotate an endpoint signing secret
Returns the new `secret` once. The previous secret keeps signing for 24 h — during that window every delivery carries TWO `v1=` entries, so accept the request if either verifies. `previousSecretExpiresAt` tells you when the old one stops. Required scope: `webhooks.manage`.
/webhook-endpoints/{endpointId}/rotate-secretAuthorization
ApiKeyAuth An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/webhook-endpoints/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate-secret"{ "data": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "url": "string", "description": "string", "subscribedEvents": [ "string" ], "payloadConfig": null, "status": "ENABLED", "consecutiveFailures": 0, "lastSuccessAt": "string", "lastFailureAt": "string", "autoDisabledAt": "string", "previousSecretExpiresAt": "string", "createdAt": "string", "updatedAt": "string", "secret": "string" }}Redeliver a webhook delivery POST
Allowed from `SUCCEEDED`, `EXHAUSTED`, `SKIPPED` and `RETRYING`. `attemptCount` is preserved — it is the record of how hard we tried. The delivery is picked up within about 90 seconds. Required scope: `webhooks.manage`.
Send a test event POST
Sends a real event through the full delivery pipeline (signature, SSRF vetting, 10 s timeout), so a green result means your endpoint will actually work. The body is optional — omit it for a plain `ping`, or name any catalogued `eventType` to receive that type’s SAMPLE payload (the same object `GET /meta/event-types` publishes as `sampleEnvelope`). Every delivery from this route carries a `Mediflo-Event-Test: true` request header, which real events never do — branch on it to drop test traffic. Repeated sends of the SAME type within one minute collapse onto a single event (each still gets its own delivery row); different types never collapse. Asynchronous: poll the returned `deliveryId` in the delivery log. The endpoint must be `ENABLED`. Required scope: `webhooks.manage`.