API Token Rotated

Triggered when a workspace Public API token is rotated via the Partner API.

WEBHOOK api_token:rotated

Example Request Body

{
  "workspace_id": "my-workspace",
  "event_type": "api_token:rotated",
  "partner_id": "partner_12345",
  "triggered_at": "2024-01-01T12:00:00.000Z",
  "rotated_at": "2024-01-01T12:00:00.000Z"
}

Headers

X-TL-Partner-Id · string · required

The unique identifier for the partner.

X-TL-Signature · string · required

A JSON Web Token (JWT) signed with your Partner Secret using the HS256 algorithm. Use this header to verify that the webhook was genuinely sent by TimelinesAI.

The JWT contains the following claims: | Claim | Description | |-------|-------------| | partner_id | Your partner identifier — must match the X-TL-Partner-Id header | | nbf | Not-before timestamp (Unix epoch) | | exp | Expiration timestamp (Unix epoch) |

Verification steps:

1. Extract the X-TL-Signature header value from the incoming request.
2. Decode and verify the JWT using your Partner Secret with the HS256 algorithm.
3. Confirm that the partner_id claim matches the X-TL-Partner-Id header.
4. Reject the request if verification fails (invalid signature, expired token, or mismatched partner ID).

JavaScript example:

const jwt = require(''jsonwebtoken'');
function verifyWebhook(req) {
  const signature = req.headers[''x-tl-signature''];
  const partnerId = req.headers[''x-tl-partner-id''];
  try {
    const decoded = jwt.verify(signature, PARTNER_SECRET);
    return decoded.partner_id === partnerId;
  } catch (err) {
    return false;
  }
}

Python example:

import jwt
def verify_webhook(headers):
    signature = headers.get(''X-TL-Signature'')
    partner_id = headers.get(''X-TL-Partner-Id'')
    try:
        decoded = jwt.decode(signature, PARTNER_SECRET, algorithms=[''HS256''])
        return decoded[''partner_id''] == partner_id
    except jwt.InvalidTokenError:
        return False

See the PartnerAPI Webhooks Overview for more details.

Body

application/json

workspace_id · string · required

Example:

"my-workspace"

event_type · enum<string> · required

Partner webhook event name.

Available options: api_token:rotated

Example:

"api_token:rotated"

partner_id · string · required

Unique identifier of the partner that owns the workspace.

Example:

"partner_12345"

triggered_at · string<date-time> · required

Timestamp when the event was triggered.

Example:

"2024-01-01T12:00:00.000Z"

rotated_at · string<date-time> · required

Example:

"2024-01-01T12:00:00.000Z"

Response

200

Receiver accepted the event