---
title: "Configure webhook secret"
method: POST
path: "/webhook/{webhook_uuid}/rotate-secret"
tags: ["Org Level Webhooks"]
---

# Configure webhook secret

`POST /webhook/{webhook_uuid}/rotate-secret`

This API configures the secret key for a specific org-level webhook. Use this endpoint to add a new secret or update an existing one. The secret is used to sign webhook payloads using HMAC SHA256, allowing you to verify that requests originate from Ocrolus.

## Path parameters

- `webhook_uuid` string, uuid, required

## Request body

- object
  - `secret_key` string, required — The new webhook secret key. Must be between 16 and 128 characters long.

## Response `200`

Success

- object — Schema for the successful response of new secret key.
  - `response` object
    - `status` string — Indicates the request status.
    - `message` string — Confirmation message.

## Other responses

- `404` — Webhook Not Found

---

[API](https://skmtc.net/ocrolus/apis/user-management.md) · [All operations](https://skmtc.net/ocrolus/apis/user-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ocrolus/user-management/versions/3571ef602d13/schema)