opschain admin inbound-webhooks update
Included from Basic tier
Updates an inbound webhook connection by code or id: any mix of display
name, service account, replay window, rate limit and enabled state. A
supplied secret (via --secret-env or --secret-prompt) rotates the
stored one — rotate on the same schedule as the external system so in-flight
deliveries signed with the old secret are refused, loudly, rather than
accepted.
NEW_SECRET=$(openssl rand -hex 32) opschain admin inbound-webhooks update ghmain \
--secret-env NEW_SECRET
Updated inbound webhook connection ghmain
Disabling a connection (--enabled=false) makes its endpoint answer a named
403 (plus a warn:webhooks:refused event) without deleting the dedup
ledger or the configuration; deliveries already accepted but not yet fired
settle failed by name rather than executing from a disabled connection.
Flags
| Flag | Meaning |
|---|---|
--secret-env <name> | Name of an environment variable holding the replacement HMAC signing secret (never pass the value itself on the command line). |
--secret-prompt | Prompt for the replacement signing secret without echo (reads a line from stdin when piped). |
--service-account <username> | Repoint the identity every resulting trigger firing executes as. |
--display-name <name> | Human-readable connection name. |
--replay-window <seconds> | Replay window (range 30-86400). |
--rate-per-minute <n> | Per-connection request budget per minute (range 1-6000). |
--enabled | Whether the endpoint accepts deliveries. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/admin-inbound-webhooks-show— the stored state after the update.