Skip to main content
POST
/
webhook-subscriptions
/
{webhookSubscription}
/
rotate-secret
Rotate webhook secret
curl --request POST \
  --url https://app.fintoro.sk/api/public/v1/webhook-subscriptions/{webhookSubscription}/rotate-secret \
  --header 'Authorization: Bearer <token>'
{
  "id": 801,
  "companyId": 15,
  "name": "ERP sync",
  "url": "https://example.com/webhooks/fintoro",
  "isActive": true,
  "subscribedEvents": [
    "invoices.created",
    "invoices.updated"
  ],
  "lastSuccessAt": "2026-03-18T15:04:05Z",
  "lastFailureAt": "2026-03-18T15:05:42Z",
  "disabledAt": null,
  "disabledReason": null,
  "createdAt": "2026-03-18T14:59:12Z",
  "updatedAt": "2026-03-18T15:01:33Z",
  "plainTextSecret": "whsec_fintoro_8b5d7c9f4f6549f7a3e8c4fd5f55ab91"
}

Authorizations

​
Authorization
string
header
required

Bearer token created for a specific company in Integrations → API.

Path Parameters

​
webhookSubscription
integer
required

Webhook subscription ID.

Example:

801

Response

Webhook subscription secret rotated.

One webhook subscription for the current company.

​
id
integer

Internal webhook subscription ID.

Example:

801

​
companyId
integer

ID of the company that owns the subscription.

Example:

15

​
name
string | null

Optional internal subscription name used for your own orientation.

Maximum string length: 255
Example:

"ERP sync"

​
url
string<uri>

HTTPS URL where Fintoro delivers webhook requests. The hostname must point to a public IP address; localhost, .local, private ranges, and reserved addresses are rejected by the backend.

Maximum string length: 2048
Example:

"https://example.com/webhooks/fintoro"

​
isActive
boolean

When true, the subscription is active and can receive delivery requests.

Example:

true

​
subscribedEvents
enum<string>[]

List of event types delivered for this subscription.

Webhook event type that you can subscribe to and that Fintoro can deliver to your endpoint.

Available options:
clients.created,
clients.updated,
clients.deleted,
suppliers.created,
suppliers.updated,
suppliers.deleted,
bank-accounts.created,
bank-accounts.updated,
bank-accounts.deleted,
business-case-statuses.created,
business-case-statuses.updated,
business-case-statuses.deleted,
business-cases.created,
business-cases.updated,
business-cases.deleted,
contact-activity-logs.created,
contact-activity-logs.updated,
contact-activity-logs.deleted,
price-list-items.created,
price-list-items.updated,
price-list-items.deleted,
price-list-items.stock-updated,
warehouses.created,
warehouses.updated,
warehouses.deleted,
warehouse-inbound-receipts.created,
warehouse-inbound-receipts.updated,
warehouse-inbound-receipts.deleted,
warehouse-outbound-receipts.created,
warehouse-outbound-receipts.updated,
warehouse-outbound-receipts.deleted,
invoices.created,
invoices.updated,
invoices.deleted,
invoices.paid,
credit-notes.created,
credit-notes.updated,
credit-notes.deleted,
credit-notes.paid,
received-invoices.paid,
received-receipts.paid,
proformas.created,
proformas.updated,
proformas.deleted,
proformas.paid,
orders.created,
orders.updated,
orders.deleted,
quotations.created,
quotations.updated,
quotations.deleted,
document-payments.created,
document-payments.deleted
Example:
["invoices.created", "invoices.updated"]
​
lastSuccessAt
string<date-time> | null

ISO 8601 time of the last successful delivery, when one exists.

Example:

"2026-03-18T15:04:05Z"

​
lastFailureAt
string<date-time> | null

ISO 8601 time of the last failed delivery, when one exists.

Example:

"2026-03-18T15:05:42Z"

​
disabledAt
string<date-time> | null

ISO 8601 time when the subscription was disabled. In this API version it remains null unless you disable the subscription manually or a future version adds auto-disable flows.

Example:

null

​
disabledReason
string | null

Reason why the subscription was disabled, when available.

Example:

null

​
createdAt
string<date-time> | null

ISO 8601 time when the subscription was created.

Example:

"2026-03-18T14:59:12Z"

​
updatedAt
string<date-time> | null

ISO 8601 time of the last subscription change.

Example:

"2026-03-18T15:01:33Z"

​
plainTextSecret
string

Plaintext signing secret returned only during create or rotate-secret. Store it securely; it is not returned again by later responses.

Example:

"whsec_fintoro_8b5d7c9f4f6549f7a3e8c4fd5f55ab91"