Webhooks
Rotate the account webhook secret
POST
/v2/webhook/rotate-secret- Scope:
webhooks:write - Idempotency-Key:optional
- changes settings
Shown once.
Parameters
Headers
| Name | Type | Constraints | Description |
|---|---|---|---|
Idempotency-Keyoptional | Typestring | Constraints≤ 191 chars | DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with Idempotent-Replayed: true — it never runs twice. Kept 24 h. |
X-Request-Idoptional | Typestring | Constraints— | DescriptionOptional: your own request id, echoed back (otherwise we generate req_…). Quote it to support. |
Request
curl -X POST "https://mursilat.com/api/v2/webhook/rotate-secret" \
-H "Authorization: Bearer $WASLA_API_KEY" \
-H "Idempotency-Key: order-1042-confirm"const res = await fetch('https://mursilat.com/api/v2/webhook/rotate-secret', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
'Idempotency-Key': 'order-1042-confirm',
},
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);import os
import requests
headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.post(
"https://mursilat.com/api/v2/webhook/rotate-secret",
headers=headers,
timeout=30,
)
data = res.json()
if not res.ok:
raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)<?php
$ch = curl_init('https://mursilat.com/api/v2/webhook/rotate-secret');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
'Idempotency-Key: order-1042-confirm',
],
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);Response
200Example
{
"secret": "whsec_…"
}Response schema
Fields of the example answer. Expand objects and arrays.
responseobject1 fields
- secretstring "whsec_…"
Errors
Only the common authentication, rate-limit and validation errors.
Try it
Send this request from your browser to the Mursilat API.
documented examplePreview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.
Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (changes settings)
Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.
curl -X POST 'https://mursilat.com/api/v2/webhook/rotate-secret' \
-H "Authorization: Bearer $WASLA_API_KEY" \
-H 'Accept: application/json'