---
title: "Rotate the HMAC secret for a subscription"
method: POST
path: "/api/v1/webhook-subscriptions/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate the HMAC secret for a subscription

`POST /api/v1/webhook-subscriptions/{id}/rotate-secret`

Generates a new HMAC `secret` and invalidates the old one
immediately. Returns the new secret ONCE — store it before
responding to the caller. There is no grace window during which
both secrets verify; if you need an overlap, stand up a second
subscription on a distinct path, switch over, then delete the
old one.

## Path parameters

- `id` string, required

## Response `200`

Secret rotated. Body contains the new `secret` — the only place it is ever returned.

- WebhookSubscriptionRotateResponse — Standard success envelope. Endpoint-specific schemas extend this and constrain the `data` property to their concrete shape. Additional legacy keys (`status`, `log`, …) may appear alongside `success`/`data` for backwards compatibility, and some legacy handlers omit `success`, so it is not marked required.
  - `success` boolean — `true` on success (omitted by some legacy handlers).
  - `data` object, required — Endpoint-specific payload.
    - `id` string, required
    - `secret` string, required — The freshly-issued HMAC secret. Stored nowhere by Prezent after this response — capture it before forwarding.
    - `secret_prefix` string, required
    - `rotated_at` string, date-time, required

## Other responses

- `401` — Caller did not present a valid Bearer token, or the token has expired. `error.code` is one of `UNAUTHORIZED`, `INVALID_API_KEY`, `EXPIRED_API_KEY`.
- `403` — Caller is authenticated but not allowed to perform this operation. `error.code` is `FORBIDDEN`.
- `404` — Requested endpoint or resource does not exist. `error.code` is one of `ENDPOINT_NOT_FOUND`, `RESOURCE_NOT_FOUND`, `NOT_FOUND`.
- `429` — Rate limit, usage limit, or gateway-level throttle exceeded. `error.code` is `TOO_MANY_REQUESTS` (gateway throttle), `RATE_LIMIT_EXCEEDED` (per-category), or `USAGE_LIMIT_EXCEEDED` (annual quota). Default limits (all configurable per company/key): - Gateway throttle (per API key) → `TOO_MANY_REQUESTS`: 10 requests/second sustained, 5 burst, 1,000 requests/day. - Per-company, per-category sliding 60-second window → `RATE_LIMIT_EXCEEDED`. The applicable category is given by each operation's `x-rate-limit-category`. - Annual usage quota → `USAGE_LIMIT_EXCEEDED`: 50,000 slide generations/year and 1,000,000 presentation downloads/year. `X-RateLimit-Limit`/`X-RateLimit-Remaining`/`X-RateLimit-Reset` are returned on successful (2xx) responses from rate-limited endpoints and, with `Retry-After`, on the per-category `RATE_LIMIT_EXCEEDED` 429 (the headers declared below). The gateway `TOO_MANY_REQUESTS` and annual `USAGE_LIMIT_EXCEEDED` responses do not carry them. Read `X-RateLimit-Remaining` to self-throttle and honour `Retry-After` on a 429.
- `500` — Unexpected server error. `error.code` is `INTERNAL_SERVER_ERROR`.
- `503` — Service is temporarily unavailable (downstream dependency unhealthy). `error.code` is `SERVICE_UNAVAILABLE` or `EXTERNAL_SERVICE_ERROR`.
- `504` — A downstream call timed out. `error.code` is `GATEWAY_TIMEOUT`.

---

[API](https://skmtc.net/prezent/apis/prezent-platform-api.md) · [All operations](https://skmtc.net/prezent/apis/prezent-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/prezent/prezent-platform-api/revisions/a01cb764a085/schema)