---
title: "Rotate the signing secret of a webhook subscription"
method: POST
path: "/api/v2/webhooks/subscriptions/{subscriptionId}/secrets/rotate"
tags: ["Subscriptions"]
---

# Rotate the signing secret of a webhook subscription

`POST /api/v2/webhooks/subscriptions/{subscriptionId}/secrets/rotate`

> 🔑
>
> Required OAuth scope: `webhookSecrets:write`.

Rotates the signing secret for the given webhook subscription. In addition to the new signature, the events will also be signed with the legacy secret for 24 hours.

## Path parameters

- `subscriptionId` string, ObjectId, required

## Headers

- `360-api-version` 'v2.0', required

## Response `201`

Returns the new signing secret of the webhook subscription.

- SigningSecretDTO
  - `secret` string, required — The signing secret of the webhook subscription. You can use this secret to verify the authenticity of the received events.

## Other responses

- `401` — The given access token is either missing, invalid, has expired, or has been revoked.
- `403` — The given access token does not have the required OAuth scope to execute the request.
- `404` — The given `subscriptionId` does not correspond to any existing subscription.
- `429` — The client has sent too many requests in a short amount of time.

---

[API](https://skmtc.net/360learning/apis/webhook-api.md) · [All operations](https://skmtc.net/360learning/apis/webhook-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/360learning/webhook-api/versions/18374878903d/schema)