Rotate webhook signing secret

curl --request POST \
  --url https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "endpointId": "mk_we_0123456789abcdef",
  "url": "<string>",
  "description": "<string>",
  "enabled": true,
  "subscribedEvents": [],
  "signingSecretVersion": 2,
  "createdAt": "2023-11-07T05:31:56Z",
  "updatedAt": "2023-11-07T05:31:56Z",
  "lastDeliveryAt": "2023-11-07T05:31:56Z",
  "consecutiveFailures": 1,
  "signingSecret": "<string>"
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

POST

webhook_endpoints

{endpointId}

rotate-secret

Rotate webhook signing secret

curl --request POST \
  --url https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.mareaalcalina.com/v1/webhook_endpoints/{endpointId}/rotate-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "endpointId": "mk_we_0123456789abcdef",
  "url": "<string>",
  "description": "<string>",
  "enabled": true,
  "subscribedEvents": [],
  "signingSecretVersion": 2,
  "createdAt": "2023-11-07T05:31:56Z",
  "updatedAt": "2023-11-07T05:31:56Z",
  "lastDeliveryAt": "2023-11-07T05:31:56Z",
  "consecutiveFailures": 1,
  "signingSecret": "<string>"
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

{
  "error": {
    "type": "auth",
    "code": "missing_authorization",
    "message": "<string>",
    "doc": "<string>",
    "param": "<string>",
    "requestId": "req_30a9358b-70bd-44f3-aa5d-8983b558ad84",
    "requestLogUrl": "<string>",
    "recoverable": true,
    "retryAfterMs": 123,
    "nextActions": [
      {
        "label": "Validate the JSON before retrying.",
        "method": null,
        "url": null
      }
    ],
    "upgrade": {
      "currentPlan": "free",
      "requiredPlan": "pro",
      "upgradeUrl": "https://mareaalcalina.com/upgrade?planSource=api",
      "previewUrl": "<string>"
    },
    "requiredScopes": [
      "<string>"
    ],
    "heldScopes": [
      "<string>"
    ]
  }
}

Authorizations

Authorization

string

header

required

Marea API key. mk_dev_* keys are developer-scoped (bootstrap, list users, register webhook). mk_user_* keys are user-scoped (manage that one user's storefronts/products). Scopes: catalog:read, catalog:write, storefront:publish, me:verify, me:resendVerification, developer:bootstrap, developer:read, developer:issueUserKey, developer:webhooks.

Headers

Idempotency-Key

string

Optional client-supplied key. Replays of the same key within 24h return the original response. Recommended for POSTs that mutate billing/inventory.

Maximum string length: 200

Example:

"idem_b2a9f5b9-3e0c-4a5e-b3c2-7a4ce85a6b21"

Accept-Language

string

BCP-47 locale tag for localized error messages (es, en, pt). Defaults to es.

Example:

"es-MX"

Path Parameters

endpointId

string

required

Response

New secret revealed once.

PRD-14 — WebhookEndpoint plus the once-revealed signingSecret. Returned by create + rotate-secret responses only.

endpointId

string

required

Server-generated id (mk_we_ + 16-char lowercase hex).

Pattern: ^mk_we_[0-9a-f]{16}$

Example:

"mk_we_0123456789abcdef"

scope

enum<string>

required

Endpoint owner type. developer endpoints receive lifecycle events for users you bootstrapped plus order events from their storefronts; merchant endpoints receive order events for one storefront.

Available options:

developer,

merchant

url

string<uri>

required

Receiver URL. HTTPS only. Max 2048 chars. SSRF blocklist applies (loopback, private ranges, metadata hosts, .internal, etc).

description

string | null

required

Maximum string length: 256

enabled

boolean

required

When false, the dispatcher skips this endpoint without retiring it.

subscribedEvents

enum<string>[]

required

At least one event subscription is required.

Minimum array length: 1

Enum of webhook event types a WebhookEndpoint may subscribe to. Developer-scope endpoints can subscribe to any value; merchant-scope endpoints are restricted to order.* (PRD-14).

Available options:

user.verified,

user.cancelled,

order.created,

order.status_updated,

order.paid

signingSecretVersion

integer

required

Bumped by one each time the secret is rotated.

Required range: x >= 1

createdAt

string<date-time>

required

updatedAt

string<date-time>

required

lastDeliveryAt

string<date-time> | null

required

lastDeliveryStatus

enum<string> | null

required

Available options:

success,

failure,

null

consecutiveFailures

integer

required

Required range: x >= 0

signingSecret

string

required

Raw 32-byte hex signing secret. Returned ONCE on create + rotate; not readable thereafter. Store immediately.

Pattern: ^[0-9a-f]{64}$

Delete webhook endpoint Marea → receiver dispatch for `userverified`