---
title: "Rotate a webhook endpoint secret"
method: POST
path: "/v1/webhooks/endpoints/{id}/rotate"
tags: ["Webhooks - Endpoints"]
---

# Rotate a webhook endpoint secret

`POST /v1/webhooks/endpoints/{id}/rotate`

## Request

- Base URL: `https://api.0xarchive.io`
- URL: `https://api.0xarchive.io/v1/webhooks/endpoints/{id}/rotate`
- Auth: API key in header `X-API-Key`

Issue a new signing secret for the endpoint and return it. The previous secret keeps verifying for 24 hours, so a receiver can accept both while it rolls over. This and endpoint creation are the only responses that carry a secret. Authenticate with an API key or a signed-in dashboard session. Costs no credits.

## Path parameters

- `id` string, uuid, required

## Response `200`

The new signing secret

- ApiResponseWebhookEndpointSecret: API response containing a rotated signing secret.
  - `success` boolean
  - `data` WebhookEndpointSecret: A freshly rotated signing secret.
    - `secret` string, required: The new signing secret. The previous one keeps verifying for 24 hours so a receiver can roll over without dropping deliveries.
  - `note` string: How long the previous secret keeps verifying.

## Other responses

- `401`: Authentication required: the API key is missing or invalid.
- `404`: Not found. `not_found`: the resource id is unknown. `unsupported_for_venue`: the venue does not offer this datatype (`available_on` names where it is served). `route_not_found`: no route matches the path.
- `429`: Rate limit, concurrency limit or monthly credits exceeded. See `error_code`.
- `default`: Any other error. The body is an `ErrorResponse`; branch on `error_code`. A 503 (`upstream_unavailable`) carries `Retry-After`.

---

[API](https://skmtc.dev/0xarchive/apis/0xarchive-api-2.md) · [All operations](https://skmtc.dev/0xarchive/apis/0xarchive-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/0xarchive/apis/0xarchive-api-2/revisions/27076f55595f?raw)