---
title: "Rotate signing secret"
method: POST
path: "/v1/webhooks/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /v1/webhooks/rotate-secret`

Mint a fresh HMAC signing secret, returned ONCE (stored encrypted, never retrievable again). Requires an existing endpoint (set a URL first). Deliveries signed with the old secret stop verifying immediately.

## Query parameters

- `owner_kind` 'user' | 'mm'

## Response `200`

OK

- object
  - `data` object
    - `signing_secret` string — The new secret (`whsec_…`). Shown only once.

## Other responses

- `404` — Resource not found

---

[API](https://skmtc.net/totalistrading/apis/totalis-rfq-api.md) · [All operations](https://skmtc.net/totalistrading/apis/totalis-rfq-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/totalistrading/totalis-rfq-api/revisions/b0adb9a590b4/schema)