feat(webhooks): add signing secret rotation endpoint

[gabrielmfern]

Adds Resend::Webhooks.rotate_signing_secret(webhook_id) for POST /webhooks/{webhook_id}/signing-secret/rotate, returning the same { object, id, signing_secret } hash as create. Same layout as the event replay method: one method in lib, one spec asserting path, verb, and response, and a step in examples/webhooks.rb.

Ran the branch against staging: rotating a fresh webhook returned a new whsec_ secret, a deleted webhook raised Resend::Error::NotFoundError, and a non-uuid id raised Resend::Error::InvalidRequestError.

Spec: resend/resend-openapi#113
Linear: https://linear.app/resend/issue/DEV-2074

🤖 Generated with Claude Code

---

Summary by cubic

Adds Resend::Webhooks.rotate_signing_secret(webhook_id) to generate a new signing secret for a webhook. The previous secret stops validating immediately, so rotate only when you're ready to swap credentials.

^{Written for commit 647b970. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

Confidence score: 3/5

• lib/resend/webhooks.rb adds the signing-secret rotation operation without confirmed production API-key permissions; if those keys cannot call POST /webhooks/{webhook_id}/signing-secret/rotate, rotation requests may fail. Confirm the required permission is available for production keys.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/resend/webhooks.rb">

<violation number="1" location="lib/resend/webhooks.rb:195">
P2: Custom agent: **API Key Permission Check SDK Methods**

Please confirm that production API keys have permission to call the new `POST /webhooks/{webhook_id}/signing-secret/rotate` operation; otherwise existing deployments may fail with permission errors after adopting this method.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Custom agent: API Key Permission Check SDK Methods

Please confirm that production API keys have permission to call the new POST /webhooks/{webhook_id}/signing-secret/rotate operation; otherwise existing deployments may fail with permission errors after adopting this method.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/resend/webhooks.rb, line 195:

<comment>Please confirm that production API keys have permission to call the new `POST /webhooks/{webhook_id}/signing-secret/rotate` operation; otherwise existing deployments may fail with permission errors after adopting this method.</comment>

<file context>
@@ -182,6 +182,21 @@ def update(params = {})
+      #
+      # @example
+      #   Resend::Webhooks.rotate_signing_secret("4dd369bc-aa82-4ff3-97de-514ae3000ee0")
+      def rotate_signing_secret(webhook_id)
+        path = "webhooks/#{webhook_id}/signing-secret/rotate"
+        Resend::Request.new(path, {}, "post").perform
</file context>