Regenerate Webhook Secret

Generates a new random secret for the provider's inbound webhook (the calls custody makes to /v2/webhooks/custodial) and returns it.

The secret is returned exactly once, in this response. Only its hash is stored, so it cannot be read back later: copy it before leaving the response. The previous secret stops working immediately, so update the custody side in the same change.

What the secret is depends on auth_type: the password of the HTTP Basic pair (basic, with the provider's webhook.username), or the bearer token (token, sent as Authorization: Bearer <secret> or in an X-Webhook-Token header).

Two preconditions:

• the provider must already be saved with Upsert Custody Provider;
• with basic auth, the provider must already have a webhook.username, since a secret without its username could never authenticate.

Platform owner only. The caller's node must be the platform root node; any other caller is refused with 403 / 10005.

Required permission: custodial-wallet:update

Request

POST /v2/admin/custodial-wallets/{provider}/webhook-secret

Parameters

Name	Type	In	Description
provider	string	path	Required. Provider key: rudiq or taurus

Headers

Name	Description
Authorization	Required. Bearer <access_token>

Example

curl --request POST \
  --url '{{baseUrl}}/v2/admin/custodial-wallets/rudiq/webhook-secret' \
  --header 'Authorization: Bearer <access_token>'

Response

{
  "auth_type": "basic",
  "secret": "<generated_webhook_secret>"
}

Response Fields

Field	Type	Description
auth_type	string	basic or token: how custody must send the secret
secret	string	The new secret, a 32-character URL-safe random string. Shown only here

Errors

Status	Code	Description
400	10015	Unsupported provider key, the provider has not been saved yet, or basic auth without a webhook.username
403	10005	The caller is not the platform owner (domain 2)

See Errors for the error format and common codes.