---
title: "Rotate the secret of a webhook destination"
method: POST
path: "/v1/{organization}/webhook_destination/{webhook_destination_id}/rotate-secret"
tags: ["Webhook Destination"]
---

# Rotate the secret of a webhook destination

`POST /v1/{organization}/webhook_destination/{webhook_destination_id}/rotate-secret`

Replace the secret for the given webhook destination. The new secret will be returned and cannot be retrieved later.

Until the `dual_signing_stops_at` timestamp in the response, which is roughly 30 minutes after the generation of the new secret, the webhook
will be signed by both the old and the new secret. This allows the webhook consumer to transition to the new secret without downtime.

The webhook rotation can occur at most once per hour for each webhook destination.

#### Permissions
This endpoint requires the following permissions:
* `Webhook:UpdateWebhookDestination` for the webhook destination.

## Path parameters

- `webhook_destination_id` string, required — The ID for the webhook destination to rotate the secret for.
- `organization` string, required

## Headers

- `x-mongo-cluster-name` string, nullable — The Mongo cluster name to perform this request in. This is usually not needed unless the organization does not exist yet in the Amigo organization infra config database.
- `Sec-WebSocket-Protocol` string[]

## Response `200`

Succeeded.

- SrcAppEndpointsWebhookDestinationRotateWebhookDestinationSecretResponse
  - `secret` string, required — The new secret used to sign the webhook event. This is only visible once and cannot be retrieved later. For the next 30 minutes, the webhook will be signed by both the old and the new secret.
  - `dual_signing_stops_at` string, date-time, required — A UTC time where the dual-signing behavior stops. After this time, webhooks will only be signed using the new secret from this endpoint.

## Other responses

- `400` — The frequency of secret rotation is limited to once per hour.
- `401` — Invalid authorization credentials.
- `403` — Missing required permissions.
- `404` — Specified organization or webhook destination is not found.
- `409` — A related operation is in progress.
- `422` — Invalid request path parameter failed validation.
- `429` — The user has exceeded the rate limit of 20 requests per minute for this endpoint.
- `503` — The service is going through temporary maintenance.

---

[API](https://skmtc.net/amigo/apis/amigo-api.md) · [All operations](https://skmtc.net/amigo/apis/amigo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/amigo/amigo-api/revisions/f0f28319e448/schema)