Create inbound signing key

POST

/v1/inbound-endpoints/{id}/signing-keys

curl --request POST \
  --url https://api.hookbridge.io/v1/inbound-endpoints/01935abc-def0-7123-4567-890abcdef012/signing-keys \
  --header 'Authorization: Bearer <token>'

• Production

Create a new delivery signing key for an inbound forward endpoint. A maximum of 2 active keys is allowed to support safe rotation.

Authorizations

• BearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Inbound endpoint identifier (UUIDv7)

Example

01935abc-def0-7123-4567-890abcdef012

Responses

201

Inbound signing key created successfully

Media typeapplication/json

object

data

object

id

Signing key ID

string

signing_secret

The signing secret - shown only once! Store this securely for verifying webhook signatures.

string

key_hint

string

created_at

string format: date-time

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "data": {
    "id": "sk_550e8400e29b41d4a716446655440001",
    "signing_secret": "whsec_newabcdefghijklmnopqrstuvwxyz12",
    "key_hint": "wxyz",
    "created_at": "2025-12-06T12:10:00Z"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

400

Invalid request

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

404

Resource not found

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Message not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

409

Maximum signing keys reached

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint must be a valid HTTPS URL"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

500

Internal server error

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "An internal error occurred"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}