Rotate the signing secret
Mints a new signing secret and returns it once. The previous secret keeps verifying for a grace window, and BOTH sign every delivery until it expires — so you can deploy the new one without an outage. Also the recovery path for a lost secret.
bearerAuth adminAuthorizationBearer <token>An API key from the dashboard under Settings → API keys, sent as Authorization: Bearer aem_….
Authorization has two independent axes.
The scope is ranked — a key satisfies any requirement at or below its own tier:
read— see messages, contacts and metrics. Changes nothing, and cannot send.write— everythingreaddoes, plus managing templates, contacts, automations, segments and suppressions. This is what editing a template needs.admin— everythingwritedoes, plus sending configuration: domains, senders, webhook registration, kill switch, daily cap, brand.
There is no approve scope. It was a rung once; it is not one now, and a key requested with it is rejected.
The approval grant (can_approve) is a separate boolean, not a rung. Delivering mail to a real inbox needs write and the grant. Keeping them on separate axes is what makes the review gate a control rather than a convention: a key that may propose is not automatically a key that may approve its own proposal.
Give your application the lowest tier that works. Most need write and the grant — the dashboard mints that combination as Send + manage; Manage only is the same rung with the grant withheld.
Scope: admin
id*stringEndpoint id.
application/json- body
grace_minutes?integerHow long the OLD secret keeps verifying. Both secrets sign every delivery during the window, so you can deploy the new one on your own schedule. Defaults to 1440 (24h); maximum 10080 (7 days). Pass 0 to cut over immediately.
0 <= value <= 10080Rotated.
application/json- response
secret?stringThe new secret. Shown once.
previous_secret_expires_at?stringAfter this, deliveries carry only the new signature.
date-timecurl -X POST 'https://sendandretain.com/api/v1/webhooks/string/rotate-secret' \ -H 'Content-Type: application/json' \ -d '{}'{ "secret": "string", "previous_secret_expires_at": "2019-08-24T14:15:22Z"}