Webhooks for keys, top-ups and Auditor reviews, plus edit, rotate and replay
Six new webhook events: key.created and key.revoked, topup.succeeded and topup.failed, autoreload.paused, and auditor.review.completed. Endpoints can now be edited, scoped to one project, and given a new signing secret that overlaps the old one, and every delivery is listed with its body and can be replayed.
A project-scoped endpoint gets only that project's events: its budgets, its keys being created, paused, revoked or found, and its end users running out of budget. Endpoints for the whole team get everything.
Rotate secret makes a new signing secret and, for an overlap of up to 7 days (24 hours by default), signs every delivery with the old one too, so receivers keep working while you switch. The IB-Signature header then carries two v1 signatures; accept the request if either matches.
The Webhooks page lists every delivery, newest first, filtered by endpoint and status, with the body that was sent. Replay sends a delivered or failed one again. The management API has the same: PATCH /v1/webhooks/{id}, POST /v1/webhooks/{id}/rotate, GET /v1/webhooks/{id}/deliveries and POST /v1/webhooks/{id}/deliveries/{delivery_id}/replay.
More in Alerts and webhooks.