Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Rotate the signing secret of a budget's webhook channel
Replaces the HMAC-SHA256 signing secret of a budget-managed webhook channel and returns
the new one in signingSecret exactly once; the previous secret stops signing
immediately. Webhook deliveries carry
X-Publiccloud-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<body>")>;
a receiver of budget alerts obtains the secret here. 404 unless the channel is a live
budget channel the caller reaches; an email channel is 409.
RBAC: MANAGE on budgets (owner, contributor, billing-ops) -- no observability
permission is needed.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
notificationChannelId*stringThe channel and its new signing secret.
application/json- response
A budget webhook channel with its new signing secret (shown once).
channel*A notification channel that follows the alert recipient of one or more budgets.
signingSecret*stringThe new webhook signing secret; it is not retrievable again.
curl -X POST "https://example.com/scopes/string/observability/budget-notification-channels/string/actions/rotate-secret"{ "channel": { "id": "string", "type": "email", "target": "string", "budgetIds": [ "string" ], "verificationStatus": "verified", "deliveryStatus": "none", "lastDeliveryError": "string", "lastDeliveryAt": "string" }, "signingSecret": "string"}