Rotating a signing secret (rotate-secret) and re-sending ownership verification (verify) are deliberately not part of the public API — both require your account password (step-up), so they are performed in the developer portal: Webhooks