Webhook endpoint secret lifecycle

The Lifecycle

Transitions Explained

Verification provisions endpoints for declared kinds. Rotation retains two signing references until scheduled expiry. Disconnection disables ingress even during overlap; local rotation and provider registration have independent failure windows.

What Cannot Happen

A new account setup uses new endpoints rather than reopening its disabled endpoint. Sequential rotation refuses an endpoint already in overlap. Disabled ingress cannot start a signing-secret rotation.

Concurrency and Timing

Endpoint checks, secret writes and provider setup do not constitute one transaction across systems. The minute expiry pass can extend overlap during an outage. Sequential rotation refusal alone does not establish exclusion of concurrent rotation requests.