curl -X POST https://api.tracklysms.com/api/v2/webhooks/66b0f7c84a1d4b2e9c3a1f2e/rotate-secret \
  -H "X-Api-Key: trk_your_api_key"

{
  "webhook": {
    "id": "66b0f7c84a1d4b2e9c3a1f2e",
    "url": "https://hooks.bizinga.com/trackly",
    "events": ["message.delivered", "message.failed"],
    "active": true,
    "signingSecret": "new64hex...",
    "previousSigningSecret": "old64hex...",
    "signingSecretRotatedAt": "2026-07-26T16:00:00Z"
  },
  "graceExpiresAt": "2026-07-27T16:00:00Z"
}