---
title: "Rotate signing secret"
method: POST
path: "/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /webhooks/{id}/rotate-secret`

Generates a new signing secret for the webhook subscription and returns it once in the response. The previous secret is replaced immediately, so any signature verification on your endpoint must be updated to use the new value.

## Path parameters

- `id` string, uuid, required

## Response `200`

New signing secret (shown once)

- object
  - `data` object, required
    - `id` string, uuid, required
    - `url` string, required
    - `eventTypes` string[], required
    - `state` 'ACTIVE' | 'DISABLED' | 'DELETED', required
    - `health` 'healthy' | 'failing' | 'blocked', required — System-observed delivery health. `blocked` endpoints are auto-disabled after sustained failure; PATCH state=ACTIVE to re-enable.
    - `blockedAt` string, nullable, required
    - `blockedReason` string, nullable, required
    - `signingEnabled` boolean, required
    - `description` string, nullable, required
    - `createdAt` string, required
    - `updatedAt` string, required
    - `secret` string, required — Signing secret — shown only once. Store it now.

## Other responses

- `401` — Unauthorized
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.net/mobilerun/apis/workflows.md) · [All operations](https://skmtc.net/mobilerun/apis/workflows/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mobilerun/workflows/revisions/1bc499aa8f99/schema)