Rotate the signing secret
Issues a new secret (returned ONCE) and keeps the previous one for 24 hours: until previousSecretValidUntil every delivery’s X-Triggr-Signature carries two v1 values — new secret first, previous second — so switch your receiver whenever convenient inside that window.
Rotating again inside that window KEEPS the older secret — the one your receiver is actually verifying with — rather than promoting the current one, so a retried rotation can never leave your endpoint unable to verify anything. The window still runs from the FIRST rotation; it is not extended. Send an Idempotency-Key and a retry replays instead of minting another secret.
Authorizations
Organisation API key. Scoped operations carry x-triggr-scope; the scopes themselves are described in x-triggr-scopes.
Headers
OPTIONAL — omit it and this operation behaves exactly as it always has. A unique value (a UUID) you choose per request. A retry with the same key and the same method, path and body within 24 hours gets the first response replayed (status and body, with Idempotent-Replayed: true) instead of running again; the same key with a different request is refused with 422. A 5xx is not stored, so that retry runs. A one-time credential is never stored: on a replay any secret is null, with an idempotentReplayNote explaining it.
1 - 255Path Parameters
Response
OK
The new signing secret, shown ONCE. null on an Idempotency-Key replay — see idempotentReplayNote
Present only on an Idempotency-Key replay whose original response carried a one-time credential: says that the value is shown only in the original response and how to issue a fresh one

