Horeca24 Partner API › Connection

Get a new signing secret

POSThttps://management.horeca-24.de/api/partner/v1/webhook/rotate-secret

The new secret is answered once. The previous one keeps signing for 24 hours, so each delivery carries two v1= signatures in that time. Colliding rotations may answer 409 REQUEST_IN_PROGRESS with Retry-After: 2.

Headers

AuthorizationstringRequired

Bearer pk_<connectionId>.<keyId>.<secret>

The connection's API key, from the restaurant's till. Treat it as one opaque string. 401 UNAUTHORIZED for a missing, wrong, expired or revoked key; 403 CONNECTION_REVOKED for the key of a deleted connection. After a rotation by the restaurant, the previous key keeps working for 24 hours.

Response

200The new secret

webhookSecretstringRequiredpattern: ^whsec_

Answered once. Store it.

previousExpiresAtstringOptionalformat: date-time

Until when the previous secret signs too

Errors

objectErrorBody

401

UNAUTHORIZED: the key is missing, malformed, unknown, wrong, expired or revoked

403

CONNECTION_REVOKED: the restaurant deleted the connection; stop sending

409

STORE_OFFLINE, WEBHOOK_NOT_CONFIGURED, ORDER_CONFLICT, INVALID_TRANSITION or REQUEST_IN_PROGRESS. REQUEST_IN_PROGRESS carries Retry-After (seconds); retry with the same body.

Headers

Retry-AfterintegerOptional

Seconds to wait (REQUEST_IN_PROGRESS only)

POST/webhook/rotate-secret

cURL

curl -X POST https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret \
  -H "Authorization: Bearer $PARTNER_API_KEY"

Python

import os
import requests

url = "https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret"

headers = {
    "Authorization": "Bearer " + os.environ["PARTNER_API_KEY"],
}

response = requests.post(url, headers=headers)

print(response.status_code)
print(response.text)

JavaScript

const response = await fetch("https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret", {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + process.env.PARTNER_API_KEY,
  },
});

const data = await response.text();
console.log(response.status, data);

PHP

<?php
$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret',
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('PARTNER_API_KEY'),
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

Try it

Sends a real request to https://management.horeca-24.de/api/partner/v1

ServerAuthorizationNever stored, never sent to us.

Response

200

200The new secret

{
  "webhookSecret": "whsec_TmV3IHNlY3JldCwgc3RvcmUgbWUgc2FmZWx5IQ",
  "previousExpiresAt": "2026-10-16T09:00:00.000Z"
}

401

401UNAUTHORIZED: the key is missing, malformed, unknown, wrong, expired or revoked

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "path": "string",
    "details": null,
    "requestId": "string"
  }
}

403

403CONNECTION_REVOKED: the restaurant deleted the connection; stop sending

{
  "error": {
    "code": "CONNECTION_REVOKED",
    "message": "string",
    "path": "string",
    "details": null,
    "requestId": "string"
  }
}

409

409STORE_OFFLINE, WEBHOOK_NOT_CONFIGURED, ORDER_CONFLICT, INVALID_TRANSITION or REQUEST_IN_PROGRESS.

{
  "error": {
    "code": "STORE_OFFLINE",
    "message": "string",
    "path": "string",
    "details": null,
    "requestId": "string"
  }
}