> ## Documentation Index > Fetch the complete documentation index at: https://docs.yourflexpay.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate the calling application's webhook signing secret > Generates a new webhook signing secret for the authenticated application, stores only its hash, and returns the raw secret once. Use the returned `webhookSecret` to verify `X-IDaaS-Signature` on inbound webhooks. The previous webhook secret becomes invalid immediately. ## OpenAPI ````yaml /openapi/idaas.openapi.json post /v1/applications/webhook-secret/rotate openapi: 3.0.3 info: title: IDaaS – Identity as a Service API description: > ## Overview IDaaS provides globally unique, portable identity **tags** that travel with users across applications. Each tag is a short handle (e.g. `@alice`) that can carry verified claims, participate in cross-application payments, and be federated to external identity providers. ## Key Capabilities - **Tags** – create, transfer, disable, and attach claims to identity handles. - **Cross-application payments** – send money from any tag on Application A to any tag on Application B; each application has a single escrow wallet tracked for end-of-day settlement. - **Ledger** – every completed payment produces an immutable double-entry `DEBIT` / `CREDIT` pair recorded against application wallets. - **Webhooks** – real-time callbacks with HMAC-SHA256 signatures and automatic retry (up to 3 attempts with exponential back-off). - **Settlement** – a scheduled end-of-day job aggregates daily wallet movements and emits `SETTLEMENT_BATCH` Kafka events. ## Authentication 1. Register an application: `POST /v1/applications` 2. Exchange credentials for a JWT: `POST /v1/auth/token` 3. Include the JWT as `Authorization: Bearer ` on all protected calls. ## Rate Limits | Endpoint | Limit | |---|---| | `POST /v1/auth/token` | 10 req / min per IP | | `POST /v1/transactions` | 60 req / min per application | | All other | 300 req / min per IP | contact: name: ReflexPay Platform Team url: https://yourflexpay.com email: integration@yourflexpay.com license: name: Proprietary url: https://yourflexpay.com/terms version: 1.0.0 servers: - url: https://staging-idaas.yourflexpay.com/api description: Staging - url: https://idaas.yourflexpay.com/api description: Production security: - bearerAuth: [] tags: - name: Authentication description: Exchange client credentials for a JWT access token. - name: Encryption description: > JWE payload encryption – end-to-end security for API request bodies and webhook payloads. Each application receives an EC P-256 keypair at registration: - IDaaS encrypts **outbound webhooks** with the application's public key. - Applications encrypt **inbound request bodies** with the IDaaS public key. Algorithm: ECDH-ES+A256KW + A256GCM (JSON Web Encryption, RFC 7516). Use `GET /v1/keys/idaas` to fetch the IDaaS public key. Use `POST /v1/applications/keys/rotate` to rotate your application keypair. - name: Wallet description: View application escrow wallet balance and paginated ledger statement. - name: Subjects description: Manage the real-world entities (users / organisations) behind tags. - name: Tags description: Create, transfer, disable and resolve globally unique identity tags. - name: Claims description: Attach and revoke verifiable claims on tags. - name: Consent description: Issue and manage user consent tokens for claim federation. - name: Transactions description: Initiate, accept/reject, and query cross-application tag-to-tag payments. - name: Settlement description: Query end-of-day settlement batches and per-application net positions. - name: Webhooks description: >- Inspect outbound webhook delivery records for transactions. Each transaction has at most two webhook records: one RECEIVER (sent on initiation) and one SENDER (sent on acceptance/rejection/expiry). externalDocs: description: IDaaS GitHub Repository url: https://github.com/reflexpay/idaas paths: /v1/applications/webhook-secret/rotate: post: tags: - Authentication - Encryption summary: Rotate the calling application's webhook signing secret description: > Generates a new webhook signing secret for the authenticated application, stores only its hash, and returns the raw secret once. Use the returned `webhookSecret` to verify `X-IDaaS-Signature` on inbound webhooks. The previous webhook secret becomes invalid immediately. operationId: rotateWebhookSecret responses: '200': description: Webhook secret rotated - new secret returned once content: '*/*': schema: $ref: '#/components/schemas/ApiResponseApplicationResponse' '401': description: Missing or invalid bearer token content: '*/*': schema: $ref: '#/components/schemas/ApiResponseApplicationResponse' '404': description: Application not found content: '*/*': schema: $ref: '#/components/schemas/ApiResponseApplicationResponse' components: schemas: ApiResponseApplicationResponse: type: object properties: success: type: boolean message: type: string errorCode: type: string data: $ref: '#/components/schemas/ApplicationResponse' errors: type: array items: type: string timestamp: type: string format: date-time ApplicationResponse: type: object properties: id: type: string description: Application UUID format: uuid name: type: string description: Human-readable application name appHandle: type: string description: >- Short unique slug used as the tag namespace for this application (e.g. 'walletapp'). Tags are addressed as 'localTag@appHandle' across the platform. Immutable once set. example: walletapp clientId: type: string description: OAuth2-style client identifier (public) clientSecret: type: string description: >- Raw client secret – returned ONLY on first registration; never stored in plaintext readOnly: true active: type: boolean description: Whether this application can still use IDaaS redirectUris: type: string description: Space-separated list of allowed redirect URIs transactionWebhookUrl: type: string description: URL that IDaaS POSTs transaction notifications to webhookSecret: type: string description: >- Raw webhook signing secret – returned ONLY on first registration. Used to verify X-IDaaS-Signature headers on inbound webhooks via HMAC-SHA256. readOnly: true metadata: type: object additionalProperties: type: object description: Optional free-form metadata (JSON string) description: Optional free-form metadata (JSON string) logoUrl: type: string description: Optional URL of the application logo image appPublicKeyJwk: $ref: '#/components/schemas/JwkDto' appPrivateJwk: $ref: '#/components/schemas/JwkDto' encryptionEnabled: type: boolean description: >- Whether JWE payload encryption is enabled for this application. When true, IDaaS requires encrypted inbound request bodies and encrypts outbound webhooks. keyVersion: type: integer description: Current keypair version. Incremented on each rotation. format: int32 example: 1 createdAt: type: string description: ISO-8601 creation timestamp format: date-time description: Registered application (tenant) details JwkDto: type: object properties: kty: type: string crv: type: string x: type: string 'y': type: string use: type: string alg: type: string d: type: string description: >- EC P-256 private key in JWK format (includes 'd'). Returned ONLY on registration and on key rotation. Store securely – this can decrypt payloads encrypted for your application. readOnly: true securitySchemes: bearerAuth: type: http description: > Obtain a token from `POST /v1/auth/token` using your `client_id` and `client_secret`, then enter `Bearer ` here. scheme: bearer bearerFormat: JWT ````