Account

Set webhook

PUT /v1/account/webhook webhook

Set the webhook URL, or clear it with null.

Request body

Body field	Type	Meaning
`url` *	string (https://…) \| null	Must start with `https://`
`rotate_secret`	bool = false	Force a new secret even if the URL did not change

response

The secret is returned only when it is created or rotated; sending the same URL again answers unchanged with secret: null.

Status: 200, 400

request

curl -X PUT https://api.xsignalfeed.com/v1/account/webhook \
  -H "Authorization: Bearer xsf_your_key" -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/hooks/xsf"}'

response · 200 / 400

{
  "status": "set",
  "url": "https://example.com/hooks/xsf",
  "secret": "a1b2c3…",
  "rotated": true,
  "signature_header": "X-XSF-Signature",
  "algorithm": "hmac-sha256(secret, raw_body)"
}