post_v1_webhooks_id_secret

Mints a NEW HMAC signing secret for the endpoint and answers the endpoint WITH it — the only other response besides create that ever carries a secret. The old secret stops working the instant this returns: every subsequent delivery signs with the new one, with no overlap window. Call it when the subscriber is ready to swap the value on its side, not before.

Arguments

The door declares no arguments for this tool.

POST /v1/webhooks/{id}/secret requires id, which tools/list does not declare on this tool. Where that value goes in a tools/call is not something the door publishes, so this page does not guess — the same capability over plain HTTP is fully specified in the API reference below.

Call it

A tools/call carries its arguments in one flat object. This tool declares none, so the object is empty — though the operation behind it requires id, so this envelope is the shape of the call, not one that can name a resource.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "post_v1_webhooks_id_secret",
         "arguments": {}
       }
     }'

tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

The same capability over plain HTTP is in the cloud API reference, on https://api.hanzo.ai.

All 833 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01 (this build read the vendored copy; the door was unreachable).