Skip to content
aerandil.com
GitHub

Promote the secondary signing key

POST
/v1/webhook-subscriptions/{id}/promote-key
curl --request POST \
  --url https://api.aerandil.com/v1/webhook-subscriptions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/promote-key \
  --header 'Authorization: Bearer <token>'

Swap the secondary key into the primary slot and clear the secondary slot. The signal that the customer’s rotation window is closing — from this point on, only the new key signs deliveries.

Not idempotency-keyed: promote is naturally idempotent at the state level (after success, secondary is None, so a retry 422s with no_secondary_key).

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Subscription id.

Responses

Section titled “Responses”

200

Section titled “200”

Secondary promoted to primary. The returned primary_key_fingerprint is the old secondary’s fingerprint.

Media typeapplication/json

Subscription state without the signing key. The *_key_fingerprint fields are the first 8 hex chars of sha256(key) — enough to confirm a rotation worked without exposing the secret.

object
consecutive_failures
required

Resets to 0 on the first 2xx after any failure. Transitioning to dead_letter happens at 12 consecutive failures (~3-day retry window).

integer
created_at
required
string format: date-time
filter
required

Filter narrowing what the worker delivers. Empty / absent means “every event in the tenant”.

object
object_types

Narrow to events whose object_type matches one of the listed api_names. For link events, either endpoint type matching counts — a filter of ["hospitality.reservation"] includes reservation_for_guest events.

Array<string>
id
required
string format: uuid
last_delivered_seq
required

Cursor into the event log. Advances to the highest seq read on every successful delivery — filtered-out events are still cursored past so the worker stays bounded under a narrow filter.

integer
next_attempt_at

Earliest moment the worker will retry. Unset when the subscription is caught up; set in the future when an exponential-backoff retry is scheduled.

string format: date-time
primary_key_fingerprint
required

First 8 hex chars of sha256(primary_signing_key) — 16 chars in total. Exposed instead of the secret on every read.

string
/^[0-9a-f]{16}$/
secondary_key_fingerprint

Present during a key-rotation window. Cleared on promote-key.

string
/^[0-9a-f]{16}$/
status
required

Lifecycle of a webhook subscription. dead_letter is sticky — the worker stops attempting further deliveries until the customer PATCHes status back to active (and typically advances last_delivered_seq past the poison batch).

Allowed values: active paused dead_letter
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
url
required

Receiver URL. HTTPS-only (except loopback in dev).

string format: uri
Example
{
  "status": "active"
}

404

Section titled “404”

No subscription with that id for this tenant.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object
error
required
object
code
required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string
instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string
message
required

Human-readable explanation of the failure.

string
parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Examplegenerated
{
  "error": {
    "code": "example",
    "instance_id": "example",
    "message": "example",
    "parameters": "example"
  }
}

422

Section titled “422”

no_secondary_key — no rotation in progress; call /rotate-key first.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object
error
required
object
code
required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string
instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string
message
required

Human-readable explanation of the failure.

string
parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Examplegenerated
{
  "error": {
    "code": "example",
    "instance_id": "example",
    "message": "example",
    "parameters": "example"
  }
}