> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.voicecheap.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create or rotate a webhook signing secret

> Create or rotate the webhook signing secret for your personal account. Returns the new secret once; save it securely. Rotating invalidates the previous secret.

Create or rotate the webhook signing secret for your personal account. Returns the new secret once; save it securely. Rotating invalidates the previous secret.

```http theme={null}
POST https://api.voicecheap.ai/v1/actions/webhooks_create_secret
```

## Authentication and permissions

<ParamField header="x-api-key" type="string" required>
  Send a VoiceCheap API key in this header. Authorization: Bearer with the same API key is also supported. OAuth access tokens are accepted only by
  MCP, not by this REST endpoint.
</ParamField>

Required permissions: `webhooks:write`.

An active paid subscription is required. Permissions do not change team roles, resource ownership, media credits, or plan limits.

## Parameters

<ParamField body="requestId" type="string">
  Optional at the transport boundary: the server injects an identifier before validation when omitted. Supply your own stable UUID v4 to recover safely from a lost response.

  Format: "uuid". Pattern: `^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$`.
</ParamField>

<Accordion title="Complete input schema">
  The JSON Schema below preserves the exact field names, nested types, defaults, bounds, and accepted values exposed by discovery. Additional cross-field rules are listed in the operation notes.

  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "requestId": {
        "type": "string",
        "format": "uuid",
        "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$",
        "description": "UUID v4 for this action. Reuse the same ID with identical arguments on retries."
      }
    },
    "additionalProperties": false
  }
  ```
</Accordion>

## Idempotency

Use a UUID v4 in requestId or the Idempotency-Key HTTP header for each mutation. Reuse the same identifier and identical arguments after a network failure. If both are supplied, they must match. Replaying a saved request does not repeat the operation or charge another monthly call. Failed or interrupted requests are not restarted automatically.

Every mutation can return HTTP 202 when a retry finds the same request still running, even when its first execution is normally synchronous. If execution completed but resultStored is false, a retry returns HTTP 200 with saved request state instead of the original result. Retrieve the output through its domain history, result, or download action.

## Request examples

Replace example resource identifiers and media keys with values returned for your account. Keep the request identifier stable when retrying the same mutation.

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST 'https://api.voicecheap.ai/v1/actions/webhooks_create_secret' \
    --header "x-api-key: $VOICECHEAP_API_KEY" \
    --header 'Content-Type: application/json' \
    --data '{"requestId":"58d5bb53-00d0-4692-bdaf-c6650ee87e30"}'
  ```

  ```javascript JavaScript theme={null}
  const input = {
    requestId: '58d5bb53-00d0-4692-bdaf-c6650ee87e30',
  };
  const response = await fetch('https://api.voicecheap.ai/v1/actions/webhooks_create_secret', {
    method: 'POST',
    headers: {
      'x-api-key': process.env.VOICECHEAP_API_KEY,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(input),
  });
  const body = await response.json();
  if (!response.ok) throw new Error(body.code + ': ' + body.message);
  console.log(body);
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.post(
      "https://api.voicecheap.ai/v1/actions/webhooks_create_secret",
      headers={"x-api-key": os.environ["VOICECHEAP_API_KEY"]},
      json={"requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30"},
      timeout=120,
  )
  body = response.json()
  if not response.ok:
      raise RuntimeError(f"{body.get('code')}: {body.get('message')}")
  print(body)
  ```
</RequestExample>

## Response

A successful first execution returns HTTP 200 with the operation result under data. A replay may return saved request state instead. The example shows one supported response, not every optional field.

Returns the webhook settings and newly created signing secret.

<ResponseExample>
  ```json HTTP 200 theme={null}
  {
    "data": {
      "url": "https://example.com/voicecheap-events",
      "secretPrefix": "whsec_REP",
      "secretSuffix": "CRET",
      "createdAt": 1792065600000,
      "updatedAt": 1792152000000,
      "fullSecret": "whsec_REPLACE_WITH_NEW_SIGNING_SECRET"
    },
    "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30"
  }
  ```

  ```json HTTP 202 replay_running theme={null}
  {
    "data": {
      "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30",
      "operation": "webhooks_create_secret",
      "createdAt": 1792144800000,
      "updatedAt": 1792144820000,
      "status": "running",
      "pollAfterSeconds": 5
    },
    "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30"
  }
  ```

  ```json HTTP 200 replay_completed_without_result theme={null}
  {
    "data": {
      "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30",
      "operation": "webhooks_create_secret",
      "createdAt": 1792144800000,
      "updatedAt": 1792144820000,
      "status": "completed",
      "resultStored": false,
      "message": "The action completed. Retrieve its output from the corresponding history or resource action."
    },
    "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30"
  }
  ```
</ResponseExample>

## Result fields

| Field | Description |
| - | - |
| `data.url` | Saved webhook destination; an empty string when a secret exists but no URL is configured. |
| `data.secretPrefix` | Visible beginning of the signing secret. |
| `data.secretSuffix` | Visible ending of the signing secret. |
| `data.createdAt` | Webhook configuration creation timestamp in milliseconds. |
| `data.updatedAt` | Most recent webhook configuration update timestamp in milliseconds. |
| `data.fullSecret` | New full signing secret. Save it securely; later read actions return only its visible prefix and suffix. |

## Recover and poll this request

Use the same identifier even after a lost connection. If resultStored is false, retrieve the output through the corresponding history, result, or download action. Never start a second generation merely to check progress.

```bash theme={null}
curl --request POST 'https://api.voicecheap.ai/v1/actions/action_request_get' \
  --header "x-api-key: $VOICECHEAP_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{"requestId":"58d5bb53-00d0-4692-bdaf-c6650ee87e30","operation":"webhooks_create_secret"}'
```

```json HTTP 200 theme={null}
{
  "data": {
    "requestId": "58d5bb53-00d0-4692-bdaf-c6650ee87e30",
    "operation": "webhooks_create_secret",
    "status": "completed",
    "createdAt": 1792144800000,
    "updatedAt": 1792144820000,
    "resultStored": true,
    "result": {
      "url": "https://example.com/voicecheap-events",
      "secretPrefix": "whsec_REP",
      "secretSuffix": "CRET",
      "createdAt": 1792065600000,
      "updatedAt": 1792152000000,
      "fullSecret": "whsec_REPLACE_WITH_NEW_SIGNING_SECRET"
    }
  }
}
```

## Operation notes

* webhooks\_create\_secret is REST-only. It is excluded from MCP discovery; calling it or polling it through MCP returns the tool error ACTION\_NOT\_AVAILABLE\_IN\_MCP. Signing secrets are not sent to assistants.
* Creating a secret when one already exists rotates it and immediately invalidates the previous secret.
* The existing webhook URL is retained. For the first secret, url is an empty string until configured.
* Use a unique requestId for the intended rotation and reuse that same ID on retries so a lost response does not trigger another rotation.

## Usage

Each successful invocation consumes one monthly API/MCP call. Media credits and the operation's own generation allowances also apply.

## Errors

| HTTP status | Code | Meaning or recovery |
| - | - | - |
| 400 | `BAD_REQUEST` | The authenticated account could not be found. |
| 400 | `CREDENTIAL_IN_QUERY` | Credentials were supplied in an access\_token or api\_key query parameter. Send credentials in headers. |
| 400 | `IDEMPOTENCY_CONFLICT` | The Idempotency-Key header and requestId body field must match. |
| 400 | `INVALID_REQUEST_ID` | Supply a UUID v4 requestId or Idempotency-Key. |
| 400 | `VALIDATION_ERROR` | The JSON object contains an unsupported field, an invalid value, or a missing required argument. |
| 401 | `API_KEY_EXPIRED` | The API key has expired. |
| 401 | `INVALID_API_KEY` | Provide a valid, unexpired API key. |
| 401 | `INVALID_CREDENTIAL` | The Authorization header is malformed or conflicts with x-api-key. |
| 401 | `MISSING_CREDENTIAL` | No usable header credential was supplied, or it exceeded 4096 characters. |
| 401 | `USER_NOT_FOUND` | The credential's account no longer exists. |
| 403 | `ACCOUNT_UNAVAILABLE` | The acting or billing account is unavailable or being deleted. |
| 403 | `AMBIGUOUS_TEAM_API_KEY` | The credential's user belongs to more than one team, so the billing context is ambiguous. |
| 403 | `INSUFFICIENT_SCOPE` | Grant every required permission or choose another credential. |
| 403 | `INTEGRATION_PLAN_UNSUPPORTED` | The account's integration limits could not be verified. |
| 403 | `SUBSCRIPTION_REQUIRED` | Use an active paid subscription. |
| 403 | `TEAM_OWNER_NOT_FOUND` | The effective team owner account could not be found. |
| 409 | `CONCURRENT_ACTION_LIMIT_REACHED` | This account already has 10 integration actions running. Poll an existing request before starting another. |
| 409 | `IDEMPOTENCY_CONFLICT` | Reuse an identifier only with the same operation and arguments. |
| 429 | `INTEGRATION_MONTHLY_LIMIT_REACHED` | Wait for the monthly reset or change plan. |
| 429 | `INTEGRATION_RATE_LIMIT_REACHED` | Wait for Retry-After when present and use backoff. |
| 500 | `INTERNAL_ERROR` | Check saved request state and resource history before deciding to retry a mutation. |
| 503 | `ACTION_RESULT_UNAVAILABLE` | The action ran but its result could not be saved. Inspect saved request state and resource history before starting a new generation. |
| 503 | `SERVER_RESTARTING` | The server is restarting. Retry shortly and keep the same request identifier for a mutation. |

```json theme={null}
{
  "code": "INSUFFICIENT_SCOPE",
  "message": "This credential does not permit the requested action.",
  "status": 403,
  "details": {
    "requiredScopes": ["webhooks:write"]
  }
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.