Issue a new signing secret (the previous one keeps signing for 24 hours unless expired at once)
curl --request POST \
--url https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"expire_immediately": false
}
'import requests
url = "https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret"
payload = { "expire_immediately": False }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({expire_immediately: false})
};
fetch('https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'expire_immediately' => false
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"id": "whk_3fksgepbgj9yqv8wccdx8sxs8v",
"url": "<string>",
"events": [
"property.*"
],
"status": "active",
"health": {
"last_success_at": "2026-10-16T09:30:00Z",
"last_failure_at": "2026-10-16T09:30:00Z",
"failing_since": "2026-10-16T09:30:00Z",
"pending_deliveries": 1
},
"version": 2,
"created_at": "2026-10-16T09:30:00Z",
"updated_at": "2026-10-16T09:30:00Z",
"secret": "<string>",
"description": "<string>",
"suspended_at": "2026-10-16T09:30:00Z",
"suspended_reason": "failing",
"previous_secret_expires_at": "2026-10-16T09:30:00Z"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"required_scopes": [
"read:catalog"
],
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}Webhooks
Issue a new signing secret (the previous one keeps signing for 24 hours unless expired at once)
Issue a new signing secret (the previous one keeps signing for 24 hours unless expired at once)
curl --request POST \
--url https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"expire_immediately": false
}
'import requests
url = "https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret"
payload = { "expire_immediately": False }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({expire_immediately: false})
};
fetch('https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.gridbeds.com/api/v1/distribution/webhooks/{webhook_id}/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'expire_immediately' => false
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"id": "whk_3fksgepbgj9yqv8wccdx8sxs8v",
"url": "<string>",
"events": [
"property.*"
],
"status": "active",
"health": {
"last_success_at": "2026-10-16T09:30:00Z",
"last_failure_at": "2026-10-16T09:30:00Z",
"failing_since": "2026-10-16T09:30:00Z",
"pending_deliveries": 1
},
"version": 2,
"created_at": "2026-10-16T09:30:00Z",
"updated_at": "2026-10-16T09:30:00Z",
"secret": "<string>",
"description": "<string>",
"suspended_at": "2026-10-16T09:30:00Z",
"suspended_reason": "failing",
"previous_secret_expires_at": "2026-10-16T09:30:00Z"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"required_scopes": [
"read:catalog"
],
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}{
"type": "https://api.gridbeds.com/problems/not-found",
"title": "<string>",
"status": 499,
"instance": "<string>",
"code": "invalid_parameters",
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"detail": "<string>"
}Preview. This operation is not served yet: it is part of the released contract (version 1.0.0). Build against a mock of the contract until the sandbox serves it; see Testing: mock and sandbox.
Authorizations
A key starts with gbd_live_ (production) or gbd_test_ (sandbox) and ends in a CRC32 checksum of its
secret part, so a mistyped or truncated key is refused before any lookup, as is a key of the other
environment. The prefix is registered with public secret scanners (GitHub secret scanning, TruffleHog,
GitGuardian): a key found in a public repository is revoked at once and your technical contact is told.
Gridbeds stores only a hash of each key. One partner may hold two keys per environment during a rotation.
Operations list the scopes they need; the scopes are OAuth 2.0 scope tokens, so short-lived access tokens
from a client-credentials grant can be offered later beside keys, with the same scopes and no change to any
operation.
Path Parameters
Pattern:
^whk_[0-7][0-9a-hjkmnp-tv-z]{25}$Example:
"whk_3fksgepbgj9yqv8wccdx8sxs8v"
Body
application/json
Response
The endpoint with its new secret, shown once.
Pattern:
^whk_[0-7][0-9a-hjkmnp-tv-z]{25}$Example:
"whk_3fksgepbgj9yqv8wccdx8sxs8v"
Pattern:
^(\*|[a-z]+\.\*|[a-z]+\.[a-z_]+)$inactive: suspended (see suspended_reason); nothing is delivered until it is enabled again.
Available options:
active, inactive Show child attributes
Show child attributes
Grows on every change visible to this channel; ignore a lower one. Not a counter — do not expect consecutive values.
Required range:
x >= 1Pattern:
^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$Example:
"2026-10-16T09:30:00Z"
Pattern:
^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$Example:
"2026-10-16T09:30:00Z"
Standard Webhooks secret (32 random bytes); shown once.
Pattern:
^whsec_[A-Za-z0-9+/]+={0,2}$Pattern:
^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$Example:
"2026-10-16T09:30:00Z"
Available options:
failing, gone, null Pattern:
^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$Example:
"2026-10-16T09:30:00Z"