Skip to main content
POST
Create or rotate the webhook signing secret for your personal account. Returns the new secret once; save it securely. Rotating invalidates the previous secret.

Authentication and permissions

string
required
Send a VoiceCheap API key in this header. Authorization: Bearer with the same API key is also supported. OAuth access tokens are accepted only by MCP, not by this REST endpoint.
Required permissions: webhooks:write. An active paid subscription is required. Permissions do not change team roles, resource ownership, media credits, or plan limits.

Parameters

string
Optional at the transport boundary: the server injects an identifier before validation when omitted. Supply your own stable UUID v4 to recover safely from a lost response.Format: “uuid”. Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$.
The JSON Schema below preserves the exact field names, nested types, defaults, bounds, and accepted values exposed by discovery. Additional cross-field rules are listed in the operation notes.

Idempotency

Use a UUID v4 in requestId or the Idempotency-Key HTTP header for each mutation. Reuse the same identifier and identical arguments after a network failure. If both are supplied, they must match. Replaying a saved request does not repeat the operation or charge another monthly call. Failed or interrupted requests are not restarted automatically. Every mutation can return HTTP 202 when a retry finds the same request still running, even when its first execution is normally synchronous. If execution completed but resultStored is false, a retry returns HTTP 200 with saved request state instead of the original result. Retrieve the output through its domain history, result, or download action.

Request examples

Replace example resource identifiers and media keys with values returned for your account. Keep the request identifier stable when retrying the same mutation.

Response

A successful first execution returns HTTP 200 with the operation result under data. A replay may return saved request state instead. The example shows one supported response, not every optional field. Returns the webhook settings and newly created signing secret.

Result fields

Recover and poll this request

Use the same identifier even after a lost connection. If resultStored is false, retrieve the output through the corresponding history, result, or download action. Never start a second generation merely to check progress.
HTTP 200

Operation notes

  • webhooks_create_secret is REST-only. It is excluded from MCP discovery; calling it or polling it through MCP returns the tool error ACTION_NOT_AVAILABLE_IN_MCP. Signing secrets are not sent to assistants.
  • Creating a secret when one already exists rotates it and immediately invalidates the previous secret.
  • The existing webhook URL is retained. For the first secret, url is an empty string until configured.
  • Use a unique requestId for the intended rotation and reuse that same ID on retries so a lost response does not trigger another rotation.

Usage

Each successful invocation consumes one monthly API/MCP call. Media credits and the operation’s own generation allowances also apply.

Errors