{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/arcmira/json-schema/arcmira-webhook-secret-rotate-response-schema.json",
  "title": "WebhookSecretRotateResponse",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/arcmira-monitors-api-openapi.yml#/components/schemas/WebhookSecretRotateResponse",
  "type": "object",
  "properties": {
    "webhook_secret": {
      "type": "string",
      "description": "The NEW webhook signing secret (\"whsec_...\"). Store it securely. The same Idempotency-Key can recover it for up to 24 hours while it remains the current or valid previous secret. A displaced or expired secret returns idempotency_result_expired without rotating again."
    },
    "webhook_secret_hint": {
      "type": "string",
      "description": "Last 4 characters of the new secret, for identifying which secret you hold."
    },
    "previous_secret_expires_at": {
      "type": [
        "string",
        "null"
      ],
      "description": "End of the 24-hour overlap window. Until then, deliveries carry an additional X-Arcmira-Signature-Previous header computed with the previous secret over the same {timestamp}.{payload} string, so you can verify with either secret while you roll. Null when the monitor had no previous secret (nothing to overlap)."
    }
  },
  "required": [
    "webhook_secret",
    "webhook_secret_hint",
    "previous_secret_expires_at"
  ]
}