---
title: "Rotate webhook signing secret"
method: POST
path: "/webhooks/endpoints/{id}/secret"
tags: ["Webhooks"]
---

# Rotate webhook signing secret

`POST /webhooks/endpoints/{id}/secret`

Rotate the signing secret for a webhook endpoint. The previous secret remains valid for 24 hours. Can only be called once per 24 hours.

## Path parameters

- `id` string, required — Webhook endpoint ID

## Response `200`

Secret rotated. New signing secret shown in plaintext (only time it is visible).

- object
  - `data` object, required
    - `id` string, required
    - `name` string, required
    - `url` string, required
    - `signingSecret` string, required — Plaintext signing secret -- store securely, not shown again
    - `active` boolean, required
    - `disabledReason` string, nullable, required
    - `consecutiveFailures` number, required
    - `subscribedEvents` string[], required
    - `rotationActive` boolean, required
    - `secretExpiresAt` number
    - `createdAt` number, required
    - `updatedAt` number, required

## Other responses

- `401` — Unauthorized
- `404` — Endpoint not found
- `409` — Secret was rotated less than 24 hours ago

---

[API](https://skmtc.net/rendobar/apis/rendobar-api.md) · [All operations](https://skmtc.net/rendobar/apis/rendobar-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rendobar/rendobar-api/versions/d536c211f602/schema)