https://www.helprange.com/api/v2/webhook-endpoints/{endpoint_id}/rotate-secretA new signing secret, returned once. For 24 hours the previous secret keeps signing too (a second v1= in HelpRange-Signature), so you can switch without dropping events. Scope webhooks:manage; team administrators only (403 otherwise); live keys only – test keys get 400 livemode_required (the sandbox sends no webhooks).
Plans: Pro, Max, Unlimited, Deal Room Pass, trial. Auth: Authorization: Bearer hr_live_… (team key), X-API-Key, Authorization: Api-Key <key> or an OAuth Bearer token. Scope: webhooks:manage. Operation id: rotateWebhookSecret
| Name | In | Type | Description |
|---|---|---|---|
endpoint_id required | path | integer | Webhook endpoint id (from List webhook endpoints). (min 1) |
Header Idempotency-Key (optional, up to 255 characters): retry with the same key and body within 24 hours and you get the first response back (Idempotent-Replayed: true) – the request is not run twice. Another body: 422 idempotency_key_reused; still running: 409 idempotency_key_in_progress. More.
curl -X POST https://www.helprange.com/api/v2/webhook-endpoints/3/rotate-secret \
-H "X-API-Key: $HELPRANGE_API_KEY"const res = await fetch('https://www.helprange.com/api/v2/webhook-endpoints/3/rotate-secret', {
method: 'POST',
headers: {'X-API-Key': process.env.HELPRANGE_API_KEY},
});
const data = await res.json();
if (!res.ok) throw new Error(`${res.status}: ${data.error || data.message || data.reason}`);
console.log(data);import os
import requests
r = requests.post(
'https://www.helprange.com/api/v2/webhook-endpoints/3/rotate-secret',
headers={'X-API-Key': os.environ['HELPRANGE_API_KEY']},
timeout=60,
)
r.raise_for_status()
print(r.json())The samples read the key from the HELPRANGE_API_KEY environment variable.
| Status | Description |
|---|---|
200 | OK |
401 | Missing or invalid API key / OAuth token. Team keys: code invalid_key, key_revoked, key_expired or key_owner_removed. |
402 | Your plan does not include the REST API (the Free plan) or this feature (e.g. NDA needs Max). |
403 | The team API key lacks the scope this endpoint needs. |
404 | Not found – or not yours (the API never says which). |
405 | Wrong HTTP method for this endpoint. |
409 | The data room is frozen, the signed PDF is not ready yet, (webhooks) the team already has an endpoint / the endpoint is turned off, or (code idempotency_key_in_progress) a request with the same Idempotency-Key is still running – retry in a few seconds. |
422 | code idempotency_key_reused: this Idempotency-Key was already used in the last 24 hours with a different request (method, path or body). Use a new key for a new request. |
429 | A usage limit was reached – wait Retry-After seconds. |
{
"id": 3,
"url": "https://hooks.example.com/helprange",
"enabled": true,
"disabled_reason": null,
"disabled_at": null,
"consecutive_failures": 0,
"last_success_at": "2026-11-15T09:12:04+00:00",
"secret_rotated_at": "2026-11-15T10:00:00+00:00",
"previous_secret_expires_at": "2026-11-16T10:00:00+00:00",
"created_at": "2026-11-15T09:00:00+00:00",
"events": [
"document.acknowledged",
"document.opened",
"file_request.uploaded",
"nda.accepted",
"offer.accepted",
"offer.contact_requested",
"offer.declined",
"room.access_requested"
],
"secret": "whsec_Zr71…"
}Uses your real account. The request goes from your browser straight to www.helprange.com with your API key and acts as you – this POST changes data. The key stays in this page (in this tab's session storage only if you tick the box), is never put in a URL and is not sent to analytics. Do not paste a key on a shared computer.